)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Shivanand Tendulker \u003cstendulker@gmail.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-11-20 16:02:55 +0530"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"UEFI Secure Boot support for iLO drivers"},{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-management-"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a890539_2d9e0e57","line":7,"updated":"2014-11-20 05:35:39.000000000","message":"You must have a blank line after the title.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Shivanand Tendulker \u003cstendulker@gmail.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-11-20 16:02:55 +0530"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"UEFI Secure Boot support for iLO drivers"},{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-management-"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a890539_c62a9f8f","line":7,"in_reply_to":"5a890539_2d9e0e57","updated":"2014-11-21 08:02:22.000000000","message":"I will take care of this in next patch.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-11-20 16:02:55 +0530"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"UEFI Secure Boot support for iLO drivers"},{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-management-"},{"line_number":11,"context_line":"interfaces"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a890539_6d9f3651","line":8,"updated":"2014-11-20 05:35:39.000000000","message":"Please remove this line of \"\u003d\u003d\u003d\u003d\u003d\"","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-11-20 16:02:55 +0530"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"UEFI Secure Boot support for iLO drivers"},{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-management-"},{"line_number":11,"context_line":"interfaces"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a890539_e6187b86","line":8,"in_reply_to":"5a890539_6d9f3651","updated":"2014-11-21 08:02:22.000000000","message":"I will take care of this in next patch.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"b91f3eef5cceda927863c962de9a574263077b70","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-11-20 16:10:07 +0530"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Ironic Management Interfaces to support UEFI Secure Boot"},{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-management-"},{"line_number":11,"context_line":"interfaces"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5a890539_f97d3eb3","line":8,"updated":"2014-11-24 15:33:17.000000000","message":"Again, please remove this line from the commit message.\n\nThere should be a description of the change here. Copy the first paragraph from the spec itself:\n\n  Some of the Ironic ... deployment of Baremetal.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"}],"specs/kilo/uefi-secure-boot-management-interfaces.rst":[{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":44,"context_line":"deploy and regular boot of the node if node were to be booted using secure"},{"line_number":45,"context_line":"boot."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"UEFI Secure Boot feature is driven by UEFI standards and hence most of the"},{"line_number":48,"context_line":"vendor implementation are similar. It would be useful to have standardized"},{"line_number":49,"context_line":"Ironic Management APIs to support the same. Currently there are no Ironic"},{"line_number":50,"context_line":"Management interfaces related to UEFI secure boot."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_8557da01","line":47,"updated":"2014-11-20 05:35:39.000000000","message":"Given that other vendors also support UEFI boot, it would be good to get reviews of this spec by developers who are supporting other hardware vendors (dell, intel, cisco, fujitsu, huawei, etc...)","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":44,"context_line":"deploy and regular boot of the node if node were to be booted using secure"},{"line_number":45,"context_line":"boot."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"UEFI Secure Boot feature is driven by UEFI standards and hence most of the"},{"line_number":48,"context_line":"vendor implementation are similar. It would be useful to have standardized"},{"line_number":49,"context_line":"Ironic Management APIs to support the same. Currently there are no Ironic"},{"line_number":50,"context_line":"Management interfaces related to UEFI secure boot."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_26136367","line":47,"in_reply_to":"5a890539_8557da01","updated":"2014-11-21 08:02:22.000000000","message":"Yes. That would be helpful. it would be helpful, if  you suggest any names whom I could ping in IRC to review this spec.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"\"\"\""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"def clear_secure_boot_keys(self, task):"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"\"\"\" Clears all the keys related to secure boot in next boot"},{"line_number":77,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_0534cadc","line":74,"updated":"2014-11-20 05:35:39.000000000","message":"what is the difference between \"clear\" and \"reset\"?","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"\"\"\""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"def clear_secure_boot_keys(self, task):"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"\"\"\" Clears all the keys related to secure boot in next boot"},{"line_number":77,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_8607b71c","line":74,"in_reply_to":"5a890539_0534cadc","updated":"2014-11-21 08:02:22.000000000","message":"clear_secure_boot_keys() would remove all the OEM as well as user enrolled keys. It is as good as system is system is disabled for secure boot mode.\nIn reset_secure_boot_keys(), only user enrolled keys are removed and OEM supplied keys are reinstated into the system.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":93,"context_line":"Data model impact"},{"line_number":94,"context_line":"-----------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"None"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"REST API impact"},{"line_number":99,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_4d5d1a48","line":96,"updated":"2014-11-20 05:35:39.000000000","message":"Since the proposed three methods are asynchronous, and the node may not boot immediately, the requested change (eg, whether to use UEFI or BIOS for the next boot) must be stored somewhere.\n\nThis section should include a description of where that will be.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":93,"context_line":"Data model impact"},{"line_number":94,"context_line":"-----------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"None"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"REST API impact"},{"line_number":99,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_e105c5c2","line":96,"in_reply_to":"5a890539_4d5d1a48","updated":"2014-11-21 08:02:22.000000000","message":"I was proposing to make the these as synchronous methods, wherein internally, it would issue next boot mode change as well. \n \nBut yes, if we were to make these as asynchronous calls or rather calls to be made just before the next power cycle, then we need may need to store the corresponding boot mode change and all other firmware setting changes ( UefiOptimizedBoot should be turned on) as well. Or driver should have intelligence of list of things to be done to turn on secure boot.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"* GET /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"  * Enable or disable UEFI Secure Boot for the next boot"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"  * Method type: GET"},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_adf83e4a","line":105,"updated":"2014-11-20 05:35:39.000000000","message":"How does \"GET\" enable or disable something?\n\nShouldn\u0027t this be returning the current boot mode?","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"* GET /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"  * Enable or disable UEFI Secure Boot for the next boot"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"  * Method type: GET"},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_0193b14f","line":105,"in_reply_to":"5a890539_adf83e4a","updated":"2014-11-21 08:02:22.000000000","message":"This is a copy/paste mistake from my side. Will correct it in next patch.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":121,"context_line":"  * Response JSON body: {\"SecureBootCurrentState\": \"1\"}"},{"line_number":122,"context_line":"    or {\"SecureBootCurrentState\": \"0\"}."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"* PATCH /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"  * Enable or disable UEFI Secure Boot for the next boot"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_4dafda2b","line":124,"updated":"2014-11-20 05:35:39.000000000","message":"This should be PUT, not PATCH.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":121,"context_line":"  * Response JSON body: {\"SecureBootCurrentState\": \"1\"}"},{"line_number":122,"context_line":"    or {\"SecureBootCurrentState\": \"0\"}."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"* PATCH /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"  * Enable or disable UEFI Secure Boot for the next boot"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_574bbb2a","line":124,"in_reply_to":"5a890539_4dafda2b","updated":"2014-11-21 08:02:22.000000000","message":"I will change this in next patch.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  * URL parameters: None."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"  * JSON body: {\"SecureBootCurrentState\": \"1\"}"},{"line_number":143,"context_line":"    or {\"SecureBootCurrentState\": \"0\"}."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  * Response body is empty if successful."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_2da44e56","line":142,"updated":"2014-11-20 05:35:39.000000000","message":"You can\u0027t set the current boot state on a node which is off, or already booted. \n\nI believe a better name for this parameter is \"NextBootSecureState\"","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  * URL parameters: None."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"  * JSON body: {\"SecureBootCurrentState\": \"1\"}"},{"line_number":143,"context_line":"    or {\"SecureBootCurrentState\": \"0\"}."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  * Response body is empty if successful."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_d72c0b4d","line":142,"in_reply_to":"5a890539_2da44e56","updated":"2014-11-21 08:02:22.000000000","message":"Yes it should be NextSecureBootState. For current state name should be CurrentSecureBootState. I will correct it in next patch.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  * Response body is empty if successful."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* PATCH /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  * Clears all the keys related to secure boot in next boot"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_6dac9636","line":147,"updated":"2014-11-20 05:35:39.000000000","message":"ditto PUT not PATCH","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  * Response body is empty if successful."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* PATCH /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  * Clears all the keys related to secure boot in next boot"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_57201b49","line":147,"in_reply_to":"5a890539_6dac9636","updated":"2014-11-21 08:02:22.000000000","message":"I will change this in next patch.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":166,"context_line":""},{"line_number":167,"context_line":"  * Response body is empty if successful."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"* PATCH /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"  * Reset to default Secure Boot keys on next boot"},{"line_number":172,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_cd62ea15","line":169,"updated":"2014-11-20 05:35:39.000000000","message":"ditto PUT not PATCH","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":166,"context_line":""},{"line_number":167,"context_line":"  * Response body is empty if successful."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"* PATCH /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"  * Reset to default Secure Boot keys on next boot"},{"line_number":172,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_771b571c","line":169,"in_reply_to":"5a890539_cd62ea15","updated":"2014-11-21 08:02:22.000000000","message":"I will change this in next patch.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    * 400 if a conductor for the node\u0027s driver cannot be found."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"  * URL: /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"  * URL parameters: None."},{"line_number":186,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_0dd152cd","line":183,"updated":"2014-11-20 05:35:39.000000000","message":"this is the same URL as both methods above. These should be condensed by the URL and show the differences in the *parameters* passed","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    * 400 if a conductor for the node\u0027s driver cannot be found."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"  * URL: /v1/nodes/\u003cuuid\u003e/management/secureboot"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"  * URL parameters: None."},{"line_number":186,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_f7d66726","line":183,"in_reply_to":"5a890539_0dd152cd","updated":"2014-11-21 08:02:22.000000000","message":"Yes will change this and others like   /v1/nodes/\u003cuuid\u003e/management/secureboot/resettodefaultkeys","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":191,"context_line":"RPC API impact"},{"line_number":192,"context_line":"--------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"Four new RPC APIs would be added corresponding to the new APIs proposed above."},{"line_number":195,"context_line":"These APIs would get the correspondig information from the driver."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Driver API impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_4d019a38","line":194,"updated":"2014-11-20 05:35:39.000000000","message":"You\u0027ve proposed a single new REST API endpoint, /v1/nodes/\u003cuuid\u003e/management/secureboot, which supports two methods, GET and PATCH, which is basically just \"get\" and \"set\".\n\nIf this were implemented synchronously (the API service passes the request to the conductor immediately) it map to two RPC methods (again, get and set). \n\nHowever, \"get\" should be satisfiable by reading state from the database -- polling the BMC in real-time is strongly undesirable.\n\nAnd if I understand correctly, none of the \"set\" methods are immediately applied. They are asynchronous and should be applied during the next boot phase. Thus, they can also be stored in the database, and during the next boot the Conductor can check for un-applied changes and apply them.\n\nIf done in this way, no new RPC methods are required.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":191,"context_line":"RPC API impact"},{"line_number":192,"context_line":"--------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"Four new RPC APIs would be added corresponding to the new APIs proposed above."},{"line_number":195,"context_line":"These APIs would get the correspondig information from the driver."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Driver API impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_97c8c375","line":194,"in_reply_to":"5a890539_4d019a38","updated":"2014-11-21 08:02:22.000000000","message":"If I understand correctly, you are suggesting the settings that needs to be applied during next boot could be stored in node as part of properties and to be applied on the node by the driver before invoking next power cycle?\n\nI think this would be useful for other management APIs wherein such settings come into effect in next boot.\n\nFor get request, how would it get populated into database? Does the first call to cache it to database?","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Security impact"},{"line_number":210,"context_line":"---------------"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"None"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Other end user impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_65774ea0","line":211,"updated":"2014-11-20 05:35:39.000000000","message":"If a user expects their instance to be booted securely, how can they ensure this through Nova\u0027s API? How can they verify it?","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Security impact"},{"line_number":210,"context_line":"---------------"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"None"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Other end user impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_f7b907cc","line":211,"in_reply_to":"5a890539_65774ea0","updated":"2014-11-21 08:02:22.000000000","message":"Once the node is deployed successfully with secure boot on, The active state of the node indicates that node has booted securely. If any of the bootloader or kernel components are not signed with the signatures in node\u0027s UEFI database, the boot would fail.\nI can capture this info in this section. Are you suggesting any other thing here?","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"068036ca9e92cf7db3327ee7c4b37afbb1ffdf1f","unresolved":false,"context_lines":[{"line_number":229,"context_line":"Other deployer impact"},{"line_number":230,"context_line":"---------------------"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"None"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"Developer impact"},{"line_number":235,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_25b46634","line":232,"updated":"2014-11-20 05:35:39.000000000","message":"Is there any requirement placed upon operators who wish to provide secure-boot functionality available in their clouds, which is not required for \"normal\" boot?","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"580ecd9cd13ac93b652b51d9e3b571da15022be3","unresolved":false,"context_lines":[{"line_number":229,"context_line":"Other deployer impact"},{"line_number":230,"context_line":"---------------------"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"None"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"Developer impact"},{"line_number":235,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_170db390","line":232,"in_reply_to":"5a890539_25b46634","updated":"2014-11-21 08:02:22.000000000","message":"The images to be used in secure boot deploy needs to be signed and these signatures should be available at the node in UEFI NVRAM for the firmware to validate during boot. The OEM systems are preloaded with signatures of some of the OS vendors. For the OS images of such vendor, deployer can directly deploy such images in secure boot environment. \nIf the deployer uses any images that are custom signed then before deploying such images, deployer needs to manually enroll those certificates into the node\u0027s UEFI NVRAM.\nIt is also important that deployer has flashed the firmware which is digitally signed and its signature is part of the UEFI NVRAM.","commit_id":"02331f131af48570a0d025ec533103a1ad9862aa"},{"author":{"_account_id":10202,"name":"Wan-yen Hsu","email":"wanyenhsu@gmail.com"},"change_message_id":"3d237f4fbd60240f2dace6e86b23f51aef520134","unresolved":false,"context_lines":[{"line_number":61,"context_line":"  :param task: a task from TaskManager."},{"line_number":62,"context_line":"  :param flag: Boolean value to indicate enable or disable of UEFI secure boot"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"\"\"\""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"def get_secure_boot_state(self, task):"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_95d89f1f","line":64,"updated":"2014-11-22 02:22:53.000000000","message":"refactor my comment on patch set 1 to this set:\r\nMost BMCs (if not all) allow users to set pending firmware settings that will take effect for the next boot. So, the proposal here is to synchronously set the pending secure boot settings. This ManagementInterface will be used by Ironic driver during Deploy (invoked by Nova boot with capability set to secure_boot \"True\") to ensure atomic operation, namely the secuer boot setting is configured for the current deploy with secure_boot flavor turned on. Perhaps we should consider removing user api for secure boot settings to avoid the complication of user setting the secure boot setting for a node but Nova selects the node for non-secure-boot (bios or uefi only). We only use driver secure-boot managementInterface as part of the deploy process to ensure atomic secure boot.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"f6749c9c6d320903dddf2b7a42451df33a70f3b6","unresolved":false,"context_lines":[{"line_number":61,"context_line":"  :param task: a task from TaskManager."},{"line_number":62,"context_line":"  :param flag: Boolean value to indicate enable or disable of UEFI secure boot"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"\"\"\""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"def get_secure_boot_state(self, task):"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_76b83dc8","line":64,"in_reply_to":"5a890539_95d89f1f","updated":"2014-11-26 04:53:31.000000000","message":"Will take care in next patch.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"b91f3eef5cceda927863c962de9a574263077b70","unresolved":false,"context_lines":[{"line_number":191,"context_line":"RPC API impact"},{"line_number":192,"context_line":"--------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"Four new RPC APIs would be added corresponding to the new APIs proposed above."},{"line_number":195,"context_line":"These APIs would get the correspondig information from the driver."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Driver API impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_996fdafb","line":194,"updated":"2014-11-24 15:33:17.000000000","message":"Not necessarily as part of the node.properties (thought that could work). Perhaps a separate table, something like \"requested changes\"? This also fits into the new state machine work -- the application of such \"requested changes\" would only happen during a particular state transition (either during \"zapping\" or \"deploying\" phases, depending on whether the change requires a long or short time). See that spec for much more information on that.\n\nFor caching the current state, so GET can be satisfied async, I believe that it would need to be checked during both the deploying and teardown phases, and the known state cached at that point. Since those would be the only times when Ironic would change this option (or apply any requested / queued changes to it) then there is no need to check it at any other time.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"f6749c9c6d320903dddf2b7a42451df33a70f3b6","unresolved":false,"context_lines":[{"line_number":191,"context_line":"RPC API impact"},{"line_number":192,"context_line":"--------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"Four new RPC APIs would be added corresponding to the new APIs proposed above."},{"line_number":195,"context_line":"These APIs would get the correspondig information from the driver."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Driver API impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_96e209d3","line":194,"in_reply_to":"5a890539_996fdafb","updated":"2014-11-26 04:53:31.000000000","message":"Thanks. Will propose a new table in next spec.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"b91f3eef5cceda927863c962de9a574263077b70","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Security impact"},{"line_number":210,"context_line":"---------------"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"None"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Other end user impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_b97736d3","line":211,"updated":"2014-11-24 15:33:17.000000000","message":"How does Ironic know the boot failed? Once the deploy is complete (image is written to disk, node is rebooted) Ironic believes its work is done and the deploy state is set to ACTIVE.\n\nWhether the operating system successfully completes its initialization after that is unknowable -- from Ironic\u0027s point of view.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"b91f3eef5cceda927863c962de9a574263077b70","unresolved":false,"context_lines":[{"line_number":229,"context_line":"Other deployer impact"},{"line_number":230,"context_line":"---------------------"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"None"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"Developer impact"},{"line_number":235,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_d97402d1","line":232,"updated":"2014-11-24 15:33:17.000000000","message":"Great - that\u0027s what I thought. Please add that to this section.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"f6749c9c6d320903dddf2b7a42451df33a70f3b6","unresolved":false,"context_lines":[{"line_number":229,"context_line":"Other deployer impact"},{"line_number":230,"context_line":"---------------------"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"None"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"Developer impact"},{"line_number":235,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_d6b1f1e0","line":232,"in_reply_to":"5a890539_d97402d1","updated":"2014-11-26 04:53:31.000000000","message":"Thanks. Will update same in next patch.","commit_id":"bc2a4eb6148f2df3f920f2a83598c98c87a066df"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"d4e199b418d3e1de7e6c8760f7082c522bd46501","unresolved":false,"context_lines":[{"line_number":238,"context_line":"Work Items"},{"line_number":239,"context_line":"----------"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"1. Implement changes for new Management interfaces in REST, RPC and conductor"},{"line_number":242,"context_line":"   using RIS for iLO driver."},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_6765e51c","line":241,"updated":"2014-11-26 07:54:42.000000000","message":"There are no RPC changes for this feature. Will update in next path.","commit_id":"aa3862d4fe81245e6cc6694b4fc868cc6fb43488"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"02aedbf30e501d266b9d2e6e21a91820f55cb77e","unresolved":false,"context_lines":[{"line_number":102,"context_line":"The other two APIs viz. clear_secure_boot_keys() and reset_secure_boot_keys()"},{"line_number":103,"context_line":"upon being called would update the information in the ironic database for the"},{"line_number":104,"context_line":"node. A new field would be introduced in the nodes table of ironic database"},{"line_number":105,"context_line":"named \"requested_settings\" which would hold these requests as key/value pairs."},{"line_number":106,"context_line":"These settings would be executed on the corresponding node during \"prepare\" or"},{"line_number":107,"context_line":"\"zapping\" stage. These key/value pairs needs to be cleared from the"},{"line_number":108,"context_line":"\"requested_settings\" table once they are exercised on the node irrespective of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_b36c609f","line":105,"updated":"2014-11-26 16:27:35.000000000","message":"What keys/values would this hold? Why do we need a new field for it?","commit_id":"a008923290d322a0f0acfa6e70ecbfefbc93e69d"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"0c84af600860610648b178b73f7600576ff5f7b2","unresolved":false,"context_lines":[{"line_number":102,"context_line":"The other two APIs viz. clear_secure_boot_keys() and reset_secure_boot_keys()"},{"line_number":103,"context_line":"upon being called would update the information in the ironic database for the"},{"line_number":104,"context_line":"node. A new field would be introduced in the nodes table of ironic database"},{"line_number":105,"context_line":"named \"requested_settings\" which would hold these requests as key/value pairs."},{"line_number":106,"context_line":"These settings would be executed on the corresponding node during \"prepare\" or"},{"line_number":107,"context_line":"\"zapping\" stage. These key/value pairs needs to be cleared from the"},{"line_number":108,"context_line":"\"requested_settings\" table once they are exercised on the node irrespective of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_bd7a5475","line":105,"in_reply_to":"5a890539_b36c609f","updated":"2014-11-27 11:02:27.000000000","message":"In the context of secure boot management interfaces, it could hold key/value pairs as clear_secure_boot_keys\u003dtrue; reset_secure_boot_keys\u003dtrue. But this field could be leveraged for any other setting that needs to applied during \u0027prepare\u0027 or \u0027zapping\u0027 stage.\n\nWe need this new field as there is no field currently into node table that could store the settings that needs to be delayed till next server reset. These values in this field needs to be acted upon and cleared off subsequently upon being exercised.","commit_id":"a008923290d322a0f0acfa6e70ecbfefbc93e69d"},{"author":{"_account_id":10202,"name":"Wan-yen Hsu","email":"wanyenhsu@gmail.com"},"change_message_id":"9c7fc1ad07c16f930a357420e7b897d44a924095","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Data model impact"},{"line_number":90,"context_line":"-----------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The proposed Management APIs are asynchronous of which set_secure_boot_state()"},{"line_number":93,"context_line":"and get_secure_boot_state() are only for the driver implementation. There is"},{"line_number":94,"context_line":"no need for the REST API endpoint for the same as they are used during deploy."},{"line_number":95,"context_line":"The secure boot enable/disable operation would get carried out as part of Nova"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_e006e884","line":92,"updated":"2014-12-05 22:21:04.000000000","message":"Not quite sure what \"asynchronous\" meant here.  These proposed ManagementInterface are only used by driver during deploy.  They are not exteranl APIs.","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"5232790508f56406f09b435ad481010bd653b1da","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Data model impact"},{"line_number":90,"context_line":"-----------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The proposed Management APIs are asynchronous of which set_secure_boot_state()"},{"line_number":93,"context_line":"and get_secure_boot_state() are only for the driver implementation. There is"},{"line_number":94,"context_line":"no need for the REST API endpoint for the same as they are used during deploy."},{"line_number":95,"context_line":"The secure boot enable/disable operation would get carried out as part of Nova"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_5373134e","line":92,"in_reply_to":"5a890539_e006e884","updated":"2014-12-06 05:56:55.000000000","message":"Yes, these APIs needs to be synchronous now as they are driver APIs. Will correct it.","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":10202,"name":"Wan-yen Hsu","email":"wanyenhsu@gmail.com"},"change_message_id":"9c7fc1ad07c16f930a357420e7b897d44a924095","unresolved":false,"context_lines":[{"line_number":103,"context_line":"RPC API impact"},{"line_number":104,"context_line":"--------------"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"No new RPC API would be added for any of the proposed four Management"},{"line_number":107,"context_line":"interfaces."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Driver API impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_e02d08ff","line":106,"updated":"2014-12-05 22:21:04.000000000","message":"Only two ManagementInterface not four.","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"5232790508f56406f09b435ad481010bd653b1da","unresolved":false,"context_lines":[{"line_number":103,"context_line":"RPC API impact"},{"line_number":104,"context_line":"--------------"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"No new RPC API would be added for any of the proposed four Management"},{"line_number":107,"context_line":"interfaces."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Driver API impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_73700f41","line":106,"in_reply_to":"5a890539_e02d08ff","updated":"2014-12-06 05:56:55.000000000","message":"Yes, another typo.","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":13362,"name":"Tan Lin","email":"lin.tan@intel.com","username":"zero"},"change_message_id":"f8accbbe1683056de6173d72ff7315c97faced1b","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"In the absence of local agent on the deployed node, Ironic does not have any"},{"line_number":125,"context_line":"mechanism to know if the deployed node has booted up successfully. This is a"},{"line_number":126,"context_line":"known limitation and is applicable to secure boot images being deployed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Other end user impact"},{"line_number":129,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_ad6c5437","line":126,"updated":"2014-12-03 12:43:26.000000000","message":"As you are using Nova boot, is it possible to add a post-processing script in user data to confirm it booted up successfully?","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":13362,"name":"Tan Lin","email":"lin.tan@intel.com","username":"zero"},"change_message_id":"7c0a1fdb80ceba41b377d1d77e29b2866d324b66","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"In the absence of local agent on the deployed node, Ironic does not have any"},{"line_number":125,"context_line":"mechanism to know if the deployed node has booted up successfully. This is a"},{"line_number":126,"context_line":"known limitation and is applicable to secure boot images being deployed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Other end user impact"},{"line_number":129,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_dc12fd5f","line":126,"in_reply_to":"5a890539_ac88a86b","updated":"2014-12-04 10:51:22.000000000","message":"This is beyond Ironic. Cloud images should have cloud-init. When you use nova boot you can pass user-data to cloud-init, node will run the script after boot successful. Maybe we can do some work here.","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"acf8bffacf1a4e2ad4b87a256b427d22bbfd26eb","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"In the absence of local agent on the deployed node, Ironic does not have any"},{"line_number":125,"context_line":"mechanism to know if the deployed node has booted up successfully. This is a"},{"line_number":126,"context_line":"known limitation and is applicable to secure boot images being deployed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Other end user impact"},{"line_number":129,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_ac88a86b","line":126,"in_reply_to":"5a890539_ad6c5437","updated":"2014-12-04 04:00:38.000000000","message":"How do we put the post-processing script. When the node gets into active stage, it would boot using the user deployed image and ironic would not have any hooks/script into that image.","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"5232790508f56406f09b435ad481010bd653b1da","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"In the absence of local agent on the deployed node, Ironic does not have any"},{"line_number":125,"context_line":"mechanism to know if the deployed node has booted up successfully. This is a"},{"line_number":126,"context_line":"known limitation and is applicable to secure boot images being deployed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Other end user impact"},{"line_number":129,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_ae624faa","line":126,"in_reply_to":"5a890539_dc12fd5f","updated":"2014-12-06 05:56:55.000000000","message":"Thanks for info. Will explore on this.","commit_id":"2c371ec5f369957cc6c186e1372654180ee3f941"},{"author":{"_account_id":5805,"name":"Chris Krelle","email":"nobodycam@gmail.com","username":"nobodycam"},"change_message_id":"0e40be53cc98e5e5179d1c27a508d83ca9da558d","unresolved":false,"context_lines":[{"line_number":33,"context_line":"When the node starts with secure boot enabled, system firmware checks the"},{"line_number":34,"context_line":"signature of each piece of boot software, including firmware drivers (Option"},{"line_number":35,"context_line":"ROMs), boot loaders and the operating system. If the signatures are good,"},{"line_number":36,"context_line":"the node boots, and the firmware gives control to the operating system."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The Admin and End users having security sensitivity with respect to baremetal"},{"line_number":39,"context_line":"provisioning owing to the workloads they intend to run on the provisioned"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_4856f9cf","line":36,"updated":"2015-01-17 01:09:56.000000000","message":"With your comment in the Security impact section does this imply we won\u0027t be able to know if the node fails signature checks?","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"73cc2a5da0e90f44e85695a29f278913bcc9de9c","unresolved":false,"context_lines":[{"line_number":33,"context_line":"When the node starts with secure boot enabled, system firmware checks the"},{"line_number":34,"context_line":"signature of each piece of boot software, including firmware drivers (Option"},{"line_number":35,"context_line":"ROMs), boot loaders and the operating system. If the signatures are good,"},{"line_number":36,"context_line":"the node boots, and the firmware gives control to the operating system."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The Admin and End users having security sensitivity with respect to baremetal"},{"line_number":39,"context_line":"provisioning owing to the workloads they intend to run on the provisioned"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_4e96484a","line":36,"in_reply_to":"3a961159_4856f9cf","updated":"2015-01-17 05:23:05.000000000","message":"If the OS image being deployed  is not signed then node will never boot up as signature checks would fail. This is also the case if the node were to be deployed with the custom signatures that are not part of ILO digital signature database.\n\nThe ironic would not know of such failures as node would already be in the \u0027active\u0027 state. If we leave out the secure boot, the implications are similar to a un-bootable image being deployed onto the node.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":5805,"name":"Chris Krelle","email":"nobodycam@gmail.com","username":"nobodycam"},"change_message_id":"0e40be53cc98e5e5179d1c27a508d83ca9da558d","unresolved":false,"context_lines":[{"line_number":40,"context_line":"nodes would be interested in using secure boot provided by UEFI."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Once secure boot is enabled for a node, it cannot boot using unsigned boot"},{"line_number":43,"context_line":"images. Hence it is important to use signed bootloaders and kernel during"},{"line_number":44,"context_line":"deploy and regular boot of the node if node were to be booted using secure"},{"line_number":45,"context_line":"boot."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_c8ee69ed","line":43,"updated":"2015-01-17 01:09:56.000000000","message":"are you saying here that once enabled it can NEVER be disabled? This paragraph is a little unclear to me could you add a little more about this?","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"73cc2a5da0e90f44e85695a29f278913bcc9de9c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"nodes would be interested in using secure boot provided by UEFI."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Once secure boot is enabled for a node, it cannot boot using unsigned boot"},{"line_number":43,"context_line":"images. Hence it is important to use signed bootloaders and kernel during"},{"line_number":44,"context_line":"deploy and regular boot of the node if node were to be booted using secure"},{"line_number":45,"context_line":"boot."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_0e77e03b","line":43,"in_reply_to":"3a961159_c8ee69ed","updated":"2015-01-17 05:23:05.000000000","message":"Once secure boot is enabled, Node can boot only using signed images. Non-signed images cannot boot on this node.\n\nSecure boot mode can be disabled. A node reset is required to enable/disable secure boot.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":10202,"name":"Wan-yen Hsu","email":"wanyenhsu@gmail.com"},"change_message_id":"24934312f10968a506e66e565a3d836e3368d029","unresolved":false,"context_lines":[{"line_number":79,"context_line":"* Reset to default secure boot keys on next boot."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"But these operations to be done during teardown and can be performed as part"},{"line_number":82,"context_line":"of zapping stage and can be added as the zap steps."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Alternatives"},{"line_number":85,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_30a04491","line":82,"updated":"2015-01-12 06:46:04.000000000","message":"A minor comment- since zapping stage has been split into zapping and cleaning stages, it\u0027s better to update the spec with the new stages.  These operations are related to cleaning stage and @clean_step.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"3369cd217fc8d69bfed2cb77ae95d7f012a7da10","unresolved":false,"context_lines":[{"line_number":79,"context_line":"* Reset to default secure boot keys on next boot."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"But these operations to be done during teardown and can be performed as part"},{"line_number":82,"context_line":"of zapping stage and can be added as the zap steps."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Alternatives"},{"line_number":85,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_de928d57","line":82,"in_reply_to":"3a961159_30a04491","updated":"2015-01-13 04:21:01.000000000","message":"Yes. Will take care in the next patch.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"ade2b73f7b4db8baa241aa2d745c76e3bf914e01","unresolved":false,"context_lines":[{"line_number":124,"context_line":""},{"line_number":125,"context_line":"In the absence of local agent on the deployed node, Ironic does not have any"},{"line_number":126,"context_line":"mechanism to know if the deployed node has booted up successfully. This is a"},{"line_number":127,"context_line":"known limitation and is applicable to secure boot images being deployed."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Other end user impact"},{"line_number":130,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_387010dc","line":127,"updated":"2015-01-12 22:08:13.000000000","message":"This isn\u0027t a security impact at all, this is by design. I don\u0027t think it belongs in this spec.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"3369cd217fc8d69bfed2cb77ae95d7f012a7da10","unresolved":false,"context_lines":[{"line_number":124,"context_line":""},{"line_number":125,"context_line":"In the absence of local agent on the deployed node, Ironic does not have any"},{"line_number":126,"context_line":"mechanism to know if the deployed node has booted up successfully. This is a"},{"line_number":127,"context_line":"known limitation and is applicable to secure boot images being deployed."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Other end user impact"},{"line_number":130,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_3e98f174","line":127,"in_reply_to":"3a961159_387010dc","updated":"2015-01-13 04:21:01.000000000","message":"Yes, its by design. But since this spec deals with secure boot, it has been added for clarity as part of of Deva\u0027s comment given in patch 1 for \u0027security impact\u0027 section.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"56ab07dbb454f3aa40aeb91c61b351078df7205f","unresolved":false,"context_lines":[{"line_number":183,"context_line":"----------"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"1. Implement changes for new Management interfaces in REST and conductor"},{"line_number":186,"context_line":"   using RIS for iLO driver."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Dependencies"},{"line_number":189,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_117da66d","line":186,"updated":"2015-01-14 16:27:16.000000000","message":"Do we even imagine implementations for other drivers (especially generic like ipmitool)? if it\u0027s ilo-specific, it better live in vendor passthru\u0027s.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"30e8537d7ab96023478e4e1d3c4cbf4310860c55","unresolved":false,"context_lines":[{"line_number":183,"context_line":"----------"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"1. Implement changes for new Management interfaces in REST and conductor"},{"line_number":186,"context_line":"   using RIS for iLO driver."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Dependencies"},{"line_number":189,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_43120559","line":186,"in_reply_to":"3a961159_117da66d","updated":"2015-01-14 16:48:00.000000000","message":"Though IPMI do not support UEFI secure boot but all the major hardware vendors do support UEFI secure boot. \nIdea was these APIs would be helpful to vendor specific drivers supporting UEFI secure boot.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":13362,"name":"Tan Lin","email":"lin.tan@intel.com","username":"zero"},"change_message_id":"f41bfe7f0d250028309f335b21a651cba9c65570","unresolved":false,"context_lines":[{"line_number":183,"context_line":"----------"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"1. Implement changes for new Management interfaces in REST and conductor"},{"line_number":186,"context_line":"   using RIS for iLO driver."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Dependencies"},{"line_number":189,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_e963b9da","line":186,"in_reply_to":"3a961159_43120559","updated":"2015-01-15 08:45:47.000000000","message":"Hi Shivanand and Dmitry, I propose to combine Secure boot and Trust boot(TPM) together, they are very similar. Drivers can use Trust boot if they don\u0027t support UEFI. https://review.openstack.org/#/c/147419/\nIt\u0027s a short spec and a draft idea, we can discuss more.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"73cc2a5da0e90f44e85695a29f278913bcc9de9c","unresolved":false,"context_lines":[{"line_number":183,"context_line":"----------"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"1. Implement changes for new Management interfaces in REST and conductor"},{"line_number":186,"context_line":"   using RIS for iLO driver."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Dependencies"},{"line_number":189,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_2e72dc49","line":186,"in_reply_to":"3a961159_e963b9da","updated":"2015-01-17 05:23:05.000000000","message":"Have left few comments on your spec.","commit_id":"8e57a90c86f92f7544ad45eb8360331574f717b5"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"dd0b561e5db9045bc6892c91421e2c60efcc9943","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Ironic Management Interfaces to support UEFI Secure Boot"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-management-"},{"line_number":12,"context_line":"interfaces"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Some of the Ironic deploy drivers support UEFI boot. It would be useful to"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a930d6b_c3d8df81","line":11,"updated":"2015-01-23 01:38:10.000000000","message":"I think you need to un-wordwrap this URL in order for tests to pass.","commit_id":"2fa49c2b789eac87feac12e73c9cbceaf426bf5c"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"6cf6b6965cc5a26824c912d05d28ee904d9291d6","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Ironic Management Interfaces to support UEFI Secure Boot"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-management-"},{"line_number":12,"context_line":"interfaces"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Some of the Ironic deploy drivers support UEFI boot. It would be useful to"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a930d6b_6de8f5e2","line":11,"in_reply_to":"1a930d6b_c3d8df81","updated":"2015-01-23 04:56:48.000000000","message":"Done","commit_id":"2fa49c2b789eac87feac12e73c9cbceaf426bf5c"},{"author":{"_account_id":13719,"name":"Naohiro Tamura","email":"naohirot.openstack@gmail.com","username":"nao"},"change_message_id":"5d1b0727bf9bb83a8f1190f919aba16b4c2e271b","unresolved":false,"context_lines":[{"line_number":207,"context_line":"References"},{"line_number":208,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"None"},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a930d6b_10878662","line":210,"updated":"2015-01-23 05:47:08.000000000","message":"I think it\u0027s better to list UEFI spec, and version.\nAs far as Fujitsu, the latest UEFI version is not used.","commit_id":"64ffbf2c651d857f2bef2b5c0fc7023b88cc5b72"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"9960d60ea8783085d4144e91aaeca8bc239b028f","unresolved":false,"context_lines":[{"line_number":207,"context_line":"References"},{"line_number":208,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"None"},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a930d6b_8127aa11","line":210,"in_reply_to":"1a930d6b_10878662","updated":"2015-01-23 08:34:03.000000000","message":"Secure boot is introduced in UEFI since spec version 2.4.\nhave added link in the new patch set.","commit_id":"64ffbf2c651d857f2bef2b5c0fc7023b88cc5b72"},{"author":{"_account_id":4992,"name":"malini-k-bhandaru","email":"malini.k.bhandaru@intel.com","username":"malini-k-bhandaru"},"change_message_id":"1bb909c2d6d637de9946b0bce1e72799a8521b37","unresolved":false,"context_lines":[{"line_number":73,"context_line":"There two more operations that are possible in secure boot environment if user"},{"line_number":74,"context_line":"were to use the custom signatures, viz:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"* Clear all the keys related to secure boot in next boot"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Reset to default secure boot keys on next boot."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_4414ebf4","line":76,"updated":"2015-01-23 11:10:27.000000000","message":"How does one set keys in the first place .","commit_id":"373ba293bd22d60219ab3800333f6fca623f7600"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"62d863ed1c7b650410d2da65dd94e4d12063f384","unresolved":false,"context_lines":[{"line_number":73,"context_line":"There two more operations that are possible in secure boot environment if user"},{"line_number":74,"context_line":"were to use the custom signatures, viz:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"* Clear all the keys related to secure boot in next boot"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Reset to default secure boot keys on next boot."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_bf4596b4","line":76,"in_reply_to":"1a930d6b_4414ebf4","updated":"2015-01-23 11:42:03.000000000","message":"this would differ from vendor to vendor. For HP Proliant Gen9 servers, one can add the the custom signatures to iLO using RBSU menu.\nhttp://www.hp.com/ctg/Manual/c04398276.pdf\n\nAdditional info on Secure Boot for Linux on HP ProLiant servers\nhttp://h20195.www2.hp.com/V2/getpdf.aspx/4AA5-4496ENW.pdf","commit_id":"373ba293bd22d60219ab3800333f6fca623f7600"},{"author":{"_account_id":4992,"name":"malini-k-bhandaru","email":"malini.k.bhandaru@intel.com","username":"malini-k-bhandaru"},"change_message_id":"1bb909c2d6d637de9946b0bce1e72799a8521b37","unresolved":false,"context_lines":[{"line_number":182,"context_line":"----------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"1. Implement changes for new Management interfaces in REST and conductor"},{"line_number":185,"context_line":"   using RIS for iLO driver."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"Dependencies"},{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_449eab57","line":185,"updated":"2015-01-23 11:10:27.000000000","message":"RIS ?","commit_id":"373ba293bd22d60219ab3800333f6fca623f7600"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"62d863ed1c7b650410d2da65dd94e4d12063f384","unresolved":false,"context_lines":[{"line_number":182,"context_line":"----------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"1. Implement changes for new Management interfaces in REST and conductor"},{"line_number":185,"context_line":"   using RIS for iLO driver."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"Dependencies"},{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_1fb6aafa","line":185,"in_reply_to":"1a930d6b_449eab57","updated":"2015-01-23 11:42:03.000000000","message":"My bad, Its proliantutil library. Internally HP Proliant servers provide Rest Based inetrfaces to update secure boot settings onto iLO. Will update it to proliantutil in next patch,.","commit_id":"373ba293bd22d60219ab3800333f6fca623f7600"},{"author":{"_account_id":5805,"name":"Chris Krelle","email":"nobodycam@gmail.com","username":"nobodycam"},"change_message_id":"f0e2f87433d1dd8bc821cb605fb4640f6da97658","unresolved":false,"context_lines":[{"line_number":29,"context_line":"the loading of drivers or OS loaders that are not signed with an acceptable"},{"line_number":30,"context_line":"digital signature."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"When the node starts with secure boot enabled, system firmware checks the"},{"line_number":33,"context_line":"signature of each piece of boot software, including firmware drivers (Option"},{"line_number":34,"context_line":"ROMs), boot loaders and the operating system. If the signatures are good,"},{"line_number":35,"context_line":"the node boots, and the firmware gives control to the operating system."}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a930d6b_81a86e78","line":32,"updated":"2015-01-23 19:54:37.000000000","message":"Could you provide an example of how a operator would enable or disable the secure boot setting?","commit_id":"7678bb1fd1e697e85841ef46da29bf0fa077c194"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"854204851096fcaf9c2aeebaf95285927653848a","unresolved":false,"context_lines":[{"line_number":29,"context_line":"the loading of drivers or OS loaders that are not signed with an acceptable"},{"line_number":30,"context_line":"digital signature."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"When the node starts with secure boot enabled, system firmware checks the"},{"line_number":33,"context_line":"signature of each piece of boot software, including firmware drivers (Option"},{"line_number":34,"context_line":"ROMs), boot loaders and the operating system. If the signatures are good,"},{"line_number":35,"context_line":"the node boots, and the firmware gives control to the operating system."}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa81d914_b2bb7271","line":32,"in_reply_to":"1a930d6b_81a86e78","updated":"2015-01-28 05:15:52.000000000","message":"Operator would use the favor capability property secure_boot to request secure boot provisioning. Have elaborated this in patch set 15.","commit_id":"7678bb1fd1e697e85841ef46da29bf0fa077c194"},{"author":{"_account_id":10202,"name":"Wan-yen Hsu","email":"wanyenhsu@gmail.com"},"change_message_id":"2b78b353ee278ebc6abc0466cb6da22039ef77c8","unresolved":false,"context_lines":[{"line_number":29,"context_line":"the loading of drivers or OS loaders that are not signed with an acceptable"},{"line_number":30,"context_line":"digital signature."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"When the node starts with secure boot enabled, system firmware checks the"},{"line_number":33,"context_line":"signature of each piece of boot software, including firmware drivers (Option"},{"line_number":34,"context_line":"ROMs), boot loaders and the operating system. If the signatures are good,"},{"line_number":35,"context_line":"the node boots, and the firmware gives control to the operating system."}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a930d6b_854dbf40","line":32,"in_reply_to":"1a930d6b_81a86e78","updated":"2015-01-26 06:19:37.000000000","message":"secure boot will be enabled by the driver automatically if \"secure_boot\" flavor is specified.  Secure boot can be disabled as part of the cleaning step.","commit_id":"7678bb1fd1e697e85841ef46da29bf0fa077c194"},{"author":{"_account_id":5805,"name":"Chris Krelle","email":"nobodycam@gmail.com","username":"nobodycam"},"change_message_id":"f0e2f87433d1dd8bc821cb605fb4640f6da97658","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Nova driver impact"},{"line_number":117,"context_line":"------------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Security impact"},{"line_number":122,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a930d6b_e124d261","line":119,"updated":"2015-01-23 19:54:37.000000000","message":"Just checking here: Above you call out \"The secure boot enable/disable operation would get carried out as part of Nova boot flavor.\" is this information already already passed down to Ironic. Will there need to be any work done to support it. if so please provide some reference here.","commit_id":"7678bb1fd1e697e85841ef46da29bf0fa077c194"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"53be681d65bb36d9da18d0cdc728371673fda838","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Nova driver impact"},{"line_number":117,"context_line":"------------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Security impact"},{"line_number":122,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a930d6b_40b3c509","line":119,"in_reply_to":"1a930d6b_457bd77a","updated":"2015-01-26 07:44:57.000000000","message":"Will add the reference in patch set 12.","commit_id":"7678bb1fd1e697e85841ef46da29bf0fa077c194"},{"author":{"_account_id":10202,"name":"Wan-yen Hsu","email":"wanyenhsu@gmail.com"},"change_message_id":"2b78b353ee278ebc6abc0466cb6da22039ef77c8","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Nova driver impact"},{"line_number":117,"context_line":"------------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Security impact"},{"line_number":122,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a930d6b_457bd77a","line":119,"in_reply_to":"1a930d6b_e124d261","updated":"2015-01-26 06:19:37.000000000","message":"Nova spec \"passing flavor to Ironic\" https://review.openstack.org/#/c/136104/ will pass capability flavors to Ironic.  This spec has been approved.","commit_id":"7678bb1fd1e697e85841ef46da29bf0fa077c194"},{"author":{"_account_id":4992,"name":"malini-k-bhandaru","email":"malini.k.bhandaru@intel.com","username":"malini-k-bhandaru"},"change_message_id":"b2265ac1e29d1ba1766201d154174a8e8effb096","unresolved":false,"context_lines":[{"line_number":185,"context_line":"----------"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"1. Implement changes for new Management interfaces in iLO drivers and"},{"line_number":188,"context_line":"prloliantutil library."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Dependencies"},{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_619c155e","line":188,"updated":"2015-01-27 07:10:43.000000000","message":"nit typo","commit_id":"bc42561ff5c9f3649ed1a27fef744d6e08b84c33"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"dd1aa498880b3ea15b1c022ac6f22dea1b2a0ec5","unresolved":false,"context_lines":[{"line_number":185,"context_line":"----------"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"1. Implement changes for new Management interfaces in iLO drivers and"},{"line_number":188,"context_line":"prloliantutil library."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Dependencies"},{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_05b7dcf5","line":188,"in_reply_to":"1a930d6b_619c155e","updated":"2015-01-27 07:41:44.000000000","message":"Done","commit_id":"bc42561ff5c9f3649ed1a27fef744d6e08b84c33"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"976b835225173d0efd22b082bfceb68dfebbb2c3","unresolved":false,"context_lines":[{"line_number":29,"context_line":"the loading of drivers or OS loaders that are not signed with an acceptable"},{"line_number":30,"context_line":"digital signature."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"When the node starts with secure boot enabled, system firmware checks the"},{"line_number":33,"context_line":"signature of each piece of boot software, including firmware drivers (Option"},{"line_number":34,"context_line":"ROMs), boot loaders and the operating system. If the signatures are good,"},{"line_number":35,"context_line":"the node boots, and the firmware gives control to the operating system."}],"source_content_type":"text/x-rst","patch_set":13,"id":"fa81d914_ad696927","line":32,"updated":"2015-01-27 18:59:18.000000000","message":"Chris made a comment on patch set 11 about how the secure boot would be enabled/disabled. The response was great; but that information needs to be reflected in the spec.","commit_id":"1a6745581cddb11d48e90f182d51822dd4f92459"},{"author":{"_account_id":6618,"name":"Ruby Loo","email":"opensrloo@gmail.com","username":"rloo"},"change_message_id":"b14b4e66661a4585dac49518dc55d3478016ac76","unresolved":false,"context_lines":[{"line_number":64,"context_line":"It would be useful to have following Management interfaces to support UEFI"},{"line_number":65,"context_line":"secure boot."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"def set_secure_boot_state(self, task, flag):"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"\"\"\" Enable or disable UEFI Secure Boot for the next boot"},{"line_number":70,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa81d914_2bfa4fbd","line":67,"updated":"2015-01-29 19:22:03.000000000","message":"I\u0027d actually prefer if we didn\u0027t use \u0027state\u0027 because I\u0027m worried that it is overloaded. \n\nhow about \u0027mode\u0027. Or is \u0027set_secure_boot\u0027 sufficient?","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"8f4c72eebb59fac70265d48eb593e34fd03e78bd","unresolved":false,"context_lines":[{"line_number":64,"context_line":"It would be useful to have following Management interfaces to support UEFI"},{"line_number":65,"context_line":"secure boot."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"def set_secure_boot_state(self, task, flag):"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"\"\"\" Enable or disable UEFI Secure Boot for the next boot"},{"line_number":70,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":15,"id":"da86d52c_cdb6673d","line":67,"in_reply_to":"da86d52c_b9817d91","updated":"2015-02-02 15:20:40.000000000","message":"Based on our discussion changing the API names to get_secure_boot_mode() and set_secure_boot_mode()","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"e9773fdca21446982da1aa4b3ffc1f1ee6fd7ce0","unresolved":false,"context_lines":[{"line_number":64,"context_line":"It would be useful to have following Management interfaces to support UEFI"},{"line_number":65,"context_line":"secure boot."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"def set_secure_boot_state(self, task, flag):"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"\"\"\" Enable or disable UEFI Secure Boot for the next boot"},{"line_number":70,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa81d914_efcf5127","line":67,"in_reply_to":"fa81d914_2bfa4fbd","updated":"2015-01-30 04:34:54.000000000","message":"These API were initially proposed in a common spec.\nhttps://review.openstack.org/#/c/135228/3/specs/kilo/uefi-secure-boot.rst\n\nThe names were discussed and finalized as part of above spec. Do you still feel we should change the API names?","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":6618,"name":"Ruby Loo","email":"opensrloo@gmail.com","username":"rloo"},"change_message_id":"42ead5c958adbfc9e887fcca26d81ddff1e47468","unresolved":false,"context_lines":[{"line_number":64,"context_line":"It would be useful to have following Management interfaces to support UEFI"},{"line_number":65,"context_line":"secure boot."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"def set_secure_boot_state(self, task, flag):"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"\"\"\" Enable or disable UEFI Secure Boot for the next boot"},{"line_number":70,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":15,"id":"da86d52c_b9817d91","line":67,"in_reply_to":"fa81d914_efcf5127","updated":"2015-02-02 14:32:07.000000000","message":"After you pointed out that it wasn\u0027t in the approved spec but in the comments, I saw what you meant. I don\u0027t know that I would consider that \u0027finalized\u0027.\n\nRegardless, even if it had been finalized, I would have brought this up. I think this kind of \u0027state\u0027 is different from our use in power_state and provision_state where the state reflects the current state the node is in wrt power/provision. This secure_boot setting doesn\u0027t say whether the node is in secure_boot NOW, it just says I want to set it to this setting the next time it boots.","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":6618,"name":"Ruby Loo","email":"opensrloo@gmail.com","username":"rloo"},"change_message_id":"b14b4e66661a4585dac49518dc55d3478016ac76","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"\"\"\" Enable or disable UEFI Secure Boot for the next boot"},{"line_number":70,"context_line":"  :param task: a task from TaskManager."},{"line_number":71,"context_line":"  :param flag: Boolean value to indicate enable or disable of UEFI secure boot"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"\"\"\""},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa81d914_6bf287d3","line":71,"updated":"2015-01-29 19:22:03.000000000","message":"do we want this to be specific to UEFI? Eg, what if in the future, there is ACME technology that can do secure boot too? (I\u0027m fine with this, it doesn\u0027t really matter if UEFI is in the docstring for now. Just thought I\u0027d ask.)","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"e9773fdca21446982da1aa4b3ffc1f1ee6fd7ce0","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"\"\"\" Enable or disable UEFI Secure Boot for the next boot"},{"line_number":70,"context_line":"  :param task: a task from TaskManager."},{"line_number":71,"context_line":"  :param flag: Boolean value to indicate enable or disable of UEFI secure boot"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"\"\"\""},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa81d914_8f8ed5ce","line":71,"in_reply_to":"fa81d914_6bf287d3","updated":"2015-01-30 04:34:54.000000000","message":"I think we can leave this as it at this point of time as no APIs currently have any differentiation based on boot method. \nAlso when ACME supports secure boot, we may have to see if these interfaces would be able to cater to it.","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":6618,"name":"Ruby Loo","email":"opensrloo@gmail.com","username":"rloo"},"change_message_id":"42ead5c958adbfc9e887fcca26d81ddff1e47468","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"\"\"\" Enable or disable UEFI Secure Boot for the next boot"},{"line_number":70,"context_line":"  :param task: a task from TaskManager."},{"line_number":71,"context_line":"  :param flag: Boolean value to indicate enable or disable of UEFI secure boot"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"\"\"\""},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"da86d52c_b9589d57","line":71,"in_reply_to":"fa81d914_8f8ed5ce","updated":"2015-02-02 14:32:07.000000000","message":"Yes, that\u0027s fine with me ;)","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":6618,"name":"Ruby Loo","email":"opensrloo@gmail.com","username":"rloo"},"change_message_id":"b14b4e66661a4585dac49518dc55d3478016ac76","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"\"\"\""},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"def get_secure_boot_state(self, task):"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"\"\"\" Retrieves current enabled state of UEFI secure boot"},{"line_number":78,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa81d914_eb9af761","line":75,"updated":"2015-01-29 19:22:03.000000000","message":"ditto about \u0027state\u0027","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"e9773fdca21446982da1aa4b3ffc1f1ee6fd7ce0","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"\"\"\""},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"def get_secure_boot_state(self, task):"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"\"\"\" Retrieves current enabled state of UEFI secure boot"},{"line_number":78,"context_line":"  :param task: a task from TaskManager."}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa81d914_cfc36deb","line":75,"in_reply_to":"fa81d914_eb9af761","updated":"2015-01-30 04:34:54.000000000","message":"Same as above.","commit_id":"9c3c8ba1318ad822efa59a5bcc273eacf917899d"}]}