)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-10-19 10:57:11 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":" multiple signing certificate"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: If5760253ff73bf32408da5c6cd4deca9110a01c2"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5a890539_63999478","line":8,"updated":"2014-11-24 18:50:01.000000000","message":"Add link to the bp","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-10-19 10:57:11 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":" multiple signing certificate"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: If5760253ff73bf32408da5c6cd4deca9110a01c2"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3a961159_05269aba","line":8,"in_reply_to":"5a890539_63999478","updated":"2014-12-16 21:35:13.000000000","message":"-1 you shouldn\u0027t necessarily have a BP prior to filing the spec; in fact, it should really be up to the spec approver to file a corresponding blueprint when the spec is approved. otherwise you end up with two things tracking the same thing, and they disagree, etc, etc.","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"}],"specs/kilo/multiple-signers.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp multiple_signers  \u003chttps://blueprints.launchpad.net/keystone/+spec/multiple-signers\u003e`"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Allow multiple Keystone servers to independently sign tokens."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_65259eaa","line":14,"updated":"2014-12-16 21:35:13.000000000","message":"they already can :) at least mention independently signing tokens with unique certificates, and have one deployment successfully validating both","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"If two different Keystone servers sign tokens, they now must share a private"},{"line_number":23,"context_line":"key. This is due to the limite way that keystone signing certs are distributed."},{"line_number":24,"context_line":"When validating a token, middleware/auth_token.py has to select the correct"},{"line_number":25,"context_line":"signing certificate.  Right now, that decision is simple:  there is only one"},{"line_number":26,"context_line":"signing certificate."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_83892028","line":23,"updated":"2014-11-24 18:50:01.000000000","message":"limited*","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"If two different Keystone servers sign tokens, they now must share a private"},{"line_number":23,"context_line":"key. This is due to the limite way that keystone signing certs are distributed."},{"line_number":24,"context_line":"When validating a token, middleware/auth_token.py has to select the correct"},{"line_number":25,"context_line":"signing certificate.  Right now, that decision is simple:  there is only one"},{"line_number":26,"context_line":"signing certificate."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_8540ca36","line":23,"in_reply_to":"5a890539_83892028","updated":"2014-12-16 21:35:13.000000000","message":"s/certs/certificates/","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"If two different Keystone servers sign tokens, they now must share a private"},{"line_number":23,"context_line":"key. This is due to the limite way that keystone signing certs are distributed."},{"line_number":24,"context_line":"When validating a token, middleware/auth_token.py has to select the correct"},{"line_number":25,"context_line":"signing certificate.  Right now, that decision is simple:  there is only one"},{"line_number":26,"context_line":"signing certificate."},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_05e93a1a","line":24,"updated":"2014-12-16 21:35:13.000000000","message":"this isn\u0027t a path to anything... i just refer to it as ``auth_token`` and hope everyone will know what it\u0027s referring to, since we\u0027ve moved it so many times","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"The changes to solve this have two sides:  changes to server side keystone,"},{"line_number":34,"context_line":"and changes to the client."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"The Below diagram shows a sing user getting a token from keystone 1"},{"line_number":37,"context_line":"and using that token with two different Nova servers.  Each Nova server"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_e5e34e31","line":34,"updated":"2014-12-16 21:35:13.000000000","message":"none to ``keystonemiddleware``?","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":33,"context_line":"The changes to solve this have two sides:  changes to server side keystone,"},{"line_number":34,"context_line":"and changes to the client."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"The Below diagram shows a sing user getting a token from keystone 1"},{"line_number":37,"context_line":"and using that token with two different Nova servers.  Each Nova server"},{"line_number":38,"context_line":"has a primary Keystone server.  Prior to this flow, the certificates for"},{"line_number":39,"context_line":"each Keystone server have been shared with each other."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_05d05a52","line":36,"updated":"2014-12-16 21:35:13.000000000","message":"Keystone","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":33,"context_line":"The changes to solve this have two sides:  changes to server side keystone,"},{"line_number":34,"context_line":"and changes to the client."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"The Below diagram shows a sing user getting a token from keystone 1"},{"line_number":37,"context_line":"and using that token with two different Nova servers.  Each Nova server"},{"line_number":38,"context_line":"has a primary Keystone server.  Prior to this flow, the certificates for"},{"line_number":39,"context_line":"each Keystone server have been shared with each other."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_a3953c34","line":36,"updated":"2014-11-24 18:50:01.000000000","message":"below* single*","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":39,"context_line":"each Keystone server have been shared with each other."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":".. code-block:: javascript"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"     +-------+"},{"line_number":45,"context_line":"     |       |  4 \"fetch cert by signer\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_45ca62a2","line":42,"updated":"2014-12-16 21:35:13.000000000","message":"this isn\u0027t javascript, it\u0027s plaintext\n\n  ::","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        +-----\u003eNova 2+---------------\u003eKeystone 2 |"},{"line_number":62,"context_line":"  5 \"boot\"    |      | 6 \"fetch cert |           |"},{"line_number":63,"context_line":"              +------+  by signer\"   +-----------+"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Server changes:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_63d514e4","line":64,"updated":"2014-11-24 18:50:01.000000000","message":"Should this diagram include some more information that is Keystone to Keystone specific?","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        +-----\u003eNova 2+---------------\u003eKeystone 2 |"},{"line_number":62,"context_line":"  5 \"boot\"    |      | 6 \"fetch cert |           |"},{"line_number":63,"context_line":"              +------+  by signer\"   +-----------+"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Server changes:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_253c7693","line":64,"in_reply_to":"5a890539_63d514e4","updated":"2014-12-16 21:35:13.000000000","message":"38 \"Prior to this flow, the certificates for each Keystone server have been shared with each other.\" ?\n\ni\u0027d *really* prefer if this was a sequence diagram though... this is really hard to follow\n\ni also feel like step 4 and step 6 are most likely to happen out of scope?","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Server changes:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"1.  New API to register external Keystone servers signing and CA certificates."},{"line_number":70,"context_line":"2.  New repository for all signing certificates."},{"line_number":71,"context_line":"3.  Extend the simple_cert extension to return all of the signing certificates"},{"line_number":72,"context_line":"    in the repostiory"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_e5ffcea8","line":69,"updated":"2014-12-16 21:35:13.000000000","message":"this has huge security implications","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":69,"context_line":"1.  New API to register external Keystone servers signing and CA certificates."},{"line_number":70,"context_line":"2.  New repository for all signing certificates."},{"line_number":71,"context_line":"3.  Extend the simple_cert extension to return all of the signing certificates"},{"line_number":72,"context_line":"    in the repostiory"},{"line_number":73,"context_line":"4.  Change the CA API to allow returning multiple signing certificates"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_83de800f","line":72,"updated":"2014-11-24 18:50:01.000000000","message":"repository","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":86,"context_line":"If the signing information does not match one of the currently held"},{"line_number":87,"context_line":"certificates, the client will fetch the set of certificates from its"},{"line_number":88,"context_line":"configured keystone.  This has the potential to be abused, so the fetch"},{"line_number":89,"context_line":"mechanism needs a throttle.  A fetch should only happen once per configured"},{"line_number":90,"context_line":"interval.  This prevents rapid cycle of request (DOS style attack) while still"},{"line_number":91,"context_line":"allowing for dynamic update of certificates."},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_c3096885","line":89,"updated":"2014-11-24 18:50:01.000000000","message":"How should this be throttled? I think if we recommend that it should be throttled, we should recommend a way to do it.","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":101,"context_line":""},{"line_number":102,"context_line":"What other ways could we do this thing? Why aren\u0027t we using those? This doesn\u0027t"},{"line_number":103,"context_line":"have to be a full literature review, but it should demonstrate that thought has"},{"line_number":104,"context_line":"been put into why the proposed solution is an appropriate one."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Data Model Impact"},{"line_number":107,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_631a74c7","line":104,"updated":"2014-11-24 18:50:01.000000000","message":"This section could be removed.","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":107,"context_line":"-----------------"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"The OS-SIMPLECERT needs to be able to fetch and update all of the certificates"},{"line_number":110,"context_line":"from multiple Keystone servers, not just thw oes configured for the current"},{"line_number":111,"context_line":"server."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_036e102f","line":110,"updated":"2014-11-24 18:50:01.000000000","message":"thw oes?","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"605a7adbf79e696f18d7351d2611c67250102973","unresolved":false,"context_lines":[{"line_number":160,"context_line":"Security Impact"},{"line_number":161,"context_line":"---------------"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":164,"context_line":"consider include:"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_a51ce614","line":163,"updated":"2014-12-16 21:35:13.000000000","message":"this needs to be exhaustively detailed ... especially if you\u0027re exposing an API to register trusted signers","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"73dcbc0c4d61a1ca9a54f8c8f105397c43fa1eb5","unresolved":false,"context_lines":[{"line_number":266,"context_line":"primary author and contact."},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"Primary assignee:"},{"line_number":269,"context_line":"  \u003claunchpad-id or None\u003e"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Other contributors:"},{"line_number":272,"context_line":"  \u003claunchpad-id or None\u003e"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_a3661c4f","line":269,"updated":"2014-11-24 18:50:01.000000000","message":"is this spec going to the bikeshed right away or do we have someone lined up to do the work?","commit_id":"651e5f66a338a074a182f24a846fea54e1730c96"}]}