)]}'
{"specs/backlog/certmonger.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"79c2069f89dd858d5cabaa5483f26b4e9be8cbd9","unresolved":false,"context_lines":[{"line_number":21,"context_line":"\u003chttps://fedorahosted.org/certmonger/\u003e`_ program was built"},{"line_number":22,"context_line":"to provide operating system support for requesting and"},{"line_number":23,"context_line":"monitoring the status of X.509 certificates.  It ensures best practices, such"},{"line_number":24,"context_line":"as never exposing private keys."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Certmonger allows for a plugin architecture to marshall the certificate"},{"line_number":27,"context_line":"signing request (CSR) to the Certificate Authority (CA) and poll for a signed"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_a04efe6c","line":24,"updated":"2015-03-20 12:58:30.000000000","message":"for clarity we should state the licence agreement for certmonger - I found it hard to get an explicit answer on that (outside the general FreeIPA license)","commit_id":"1fff1302539d18dd07a122cfd17d9a04a8de0ae7"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"d4e84bdcf85eea6eaf2fa264bc1bccffc2c88f44","unresolved":false,"context_lines":[{"line_number":21,"context_line":"\u003chttps://fedorahosted.org/certmonger/\u003e`_ program was built"},{"line_number":22,"context_line":"to provide operating system support for requesting and"},{"line_number":23,"context_line":"monitoring the status of X.509 certificates.  It ensures best practices, such"},{"line_number":24,"context_line":"as never exposing private keys."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Certmonger allows for a plugin architecture to marshall the certificate"},{"line_number":27,"context_line":"signing request (CSR) to the Certificate Authority (CA) and poll for a signed"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_9dbb1c0e","line":24,"in_reply_to":"9a80dd14_a04efe6c","updated":"2015-03-26 01:04:01.000000000","message":"$ rpm -q --info certmonger | grep License\nLicense     : GPLv3+\n\nhttps://git.fedorahosted.org/cgit/certmonger.git/tree/LICENSE","commit_id":"1fff1302539d18dd07a122cfd17d9a04a8de0ae7"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"f955a841f9f795d41b41e7bea6a23da8b30407e8","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Alternatives"},{"line_number":72,"context_line":"------------"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"There is no real alternative to certmonger for talking to different CAs.  The"},{"line_number":75,"context_line":"certmonger project was started to solve this very problem for the general case."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Once Barbican has a REST url for posting a CSR, Keystone could be hard coded to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6ced46_b796744a","line":74,"updated":"2015-03-25 23:29:08.000000000","message":"A new project started by the OSSG called Anchor might be another alternative.  See https://github.com/stackforge/anchor","commit_id":"1fff1302539d18dd07a122cfd17d9a04a8de0ae7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"cb5a1ad96933f0df3045b371a2b003ab797ea741","unresolved":false,"context_lines":[{"line_number":133,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":134,"context_line":"  expansion attacks in XML."},{"line_number":135,"context_line":"* No.  It is not callable by end users."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Notifications Impact"},{"line_number":139,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_c5cb041c","line":136,"updated":"2015-03-20 12:51:05.000000000","message":"Although I don\u0027t believe it is an issue, it might be worth stating if using certmonger affects any security classification of Keystone in terms of restricted distribution due to crypto technology","commit_id":"1fff1302539d18dd07a122cfd17d9a04a8de0ae7"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"d4e84bdcf85eea6eaf2fa264bc1bccffc2c88f44","unresolved":false,"context_lines":[{"line_number":133,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":134,"context_line":"  expansion attacks in XML."},{"line_number":135,"context_line":"* No.  It is not callable by end users."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Notifications Impact"},{"line_number":139,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_5dfa84bd","line":136,"in_reply_to":"9a80dd14_c5cb041c","updated":"2015-03-26 01:04:01.000000000","message":"It uses crypto libraries and executables, but does not implement any cryptography itself.","commit_id":"1fff1302539d18dd07a122cfd17d9a04a8de0ae7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"820843e286063284b79a4f0ee8127dfea9a7cc1d","unresolved":false,"context_lines":[{"line_number":68,"context_line":"holding the keys and certificates will be passed in the popen call to"},{"line_number":69,"context_line":"certmonger."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Certmionger is capable of managing self signed certificates.  There is no need"},{"line_number":72,"context_line":"to have a full CA.  But if one is availalb,e Certmonger providers the"},{"line_number":73,"context_line":"appropriate means to communicate with the CA."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa32b979_61766907","line":71,"updated":"2015-06-18 19:59:03.000000000","message":"s/Certmionger/Certmonger/","commit_id":"d09a1192d069a6c0d6955d39912d92bab12a2d81"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3f40bb6f94d40adf3469f5d7c219c0ab21d8aaa1","unresolved":false,"context_lines":[{"line_number":69,"context_line":"certmonger."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Certmionger is capable of managing self signed certificates.  There is no need"},{"line_number":72,"context_line":"to have a full CA.  But if one is availalb,e Certmonger providers the"},{"line_number":73,"context_line":"appropriate means to communicate with the CA."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Certmonger is packaged and avialble in current versions of  Fedora/CentOS and"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa53dc9_55b5d52e","line":72,"updated":"2015-04-08 08:49:47.000000000","message":"nit: s/availalb,e/available/","commit_id":"d09a1192d069a6c0d6955d39912d92bab12a2d81"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3f40bb6f94d40adf3469f5d7c219c0ab21d8aaa1","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Debian/Ubuntu."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Certmonger is released under the GPL V3."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Alternatives"},{"line_number":81,"context_line":"------------"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa53dc9_75e8d910","line":79,"updated":"2015-04-08 08:49:47.000000000","message":"I\u0027d like us to explicitly state the current \"direct to openssl\" will still be supported with a deprecation cycle in the normal way. We shouldn\u0027t just remove a capacity and assume certmonger is acceptable to everyone.","commit_id":"d09a1192d069a6c0d6955d39912d92bab12a2d81"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f825c3f0267ed07a2087b54f3a2be5b244cccb9b","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Debian/Ubuntu."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Certmonger is released under the GPL V3."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Alternatives"},{"line_number":81,"context_line":"------------"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa32b979_9f4ac126","line":79,"in_reply_to":"9aa53dc9_75e8d910","updated":"2015-06-19 15:49:04.000000000","message":"Done","commit_id":"d09a1192d069a6c0d6955d39912d92bab12a2d81"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aedf667a85c841538fb3e505303b1433a06adb88","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Alternatives"},{"line_number":81,"context_line":"------------"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"There is no real alternative to certmonger for talking to different CAs.  The"},{"line_number":84,"context_line":"certmonger project was started to solve this very problem for the general case."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa32b979_7b7c9172","line":82,"updated":"2015-06-15 14:29:34.000000000","message":"Couldn\u0027t another alternative to the Popen openssl stuff be to use the OpenSSL python library?","commit_id":"d09a1192d069a6c0d6955d39912d92bab12a2d81"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"225a2e8846a295d60e520a32b1f84bba065d2d31","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Alternatives"},{"line_number":81,"context_line":"------------"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"There is no real alternative to certmonger for talking to different CAs.  The"},{"line_number":84,"context_line":"certmonger project was started to solve this very problem for the general case."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa32b979_4f51b50d","line":82,"in_reply_to":"fa32b979_7b7c9172","updated":"2015-06-15 20:44:00.000000000","message":"It is not really an alternative.  THe problem is not the popen, it is the self-sgining aspect of using local openssl that is a problem.","commit_id":"d09a1192d069a6c0d6955d39912d92bab12a2d81"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"375e5503fa5a1e1c5fb75cdac5fdf3050e7d6470","unresolved":false,"context_lines":[{"line_number":88,"context_line":"CLI configured with the local server could easily be turned into a certmonger"},{"line_number":89,"context_line":"plugin.  This has the added benefit of allowing other applications beyond"},{"line_number":90,"context_line":"Keystone to use the same mechanism to manage their X.509 certificates."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Security Impact"},{"line_number":93,"context_line":"---------------"},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa53dc9_b1ca086d","line":91,"updated":"2015-04-07 20:10:35.000000000","message":"Barbican has just (as of Kilo) completed some REST calls that will allow the submission of a CSR, as well as some calls to show and select amongst available CAs.\n\nI plan to write a plugin (shortly ) for certmonger to access this Barbican API.  So, integrating with certmonger will allow communication with Barbican.","commit_id":"d09a1192d069a6c0d6955d39912d92bab12a2d81"}],"specs/kilo/certmonger.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp certmonger \u003chttps://blueprints.launchpad.net/keystone/+spec/certmonger\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Replace the cutome openssl certificate generation with calls to certmonger for"},{"line_number":14,"context_line":"keystone-manage pki_setup and ssl_setup"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_05121ab4","line":13,"updated":"2014-12-16 21:54:47.000000000","message":"custom\n\ninclude a link to certmonger upon first mention","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp certmonger \u003chttps://blueprints.launchpad.net/keystone/+spec/certmonger\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Replace the cutome openssl certificate generation with calls to certmonger for"},{"line_number":14,"context_line":"keystone-manage pki_setup and ssl_setup"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_251716a5","line":14,"updated":"2014-12-16 21:54:47.000000000","message":"double backtick all the literals","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"X509 Certificate management is not trivial.  The Certmonger program was built"},{"line_number":21,"context_line":"to provide the Operating System with a uniformed approach to requesting and"},{"line_number":22,"context_line":"monitoring the status of X509 certificates.  It ensures best practices, such as"},{"line_number":23,"context_line":"never exposing private keys.  Certmonger is capable of working with both"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_c51f32b6","line":20,"updated":"2014-12-16 21:54:47.000000000","message":"X.509 certificate","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"X509 Certificate management is not trivial.  The Certmonger program was built"},{"line_number":21,"context_line":"to provide the Operating System with a uniformed approach to requesting and"},{"line_number":22,"context_line":"monitoring the status of X509 certificates.  It ensures best practices, such as"},{"line_number":23,"context_line":"never exposing private keys.  Certmonger is capable of working with both"},{"line_number":24,"context_line":"OpenSSL and NSS.  NSS specificially is necessary for organizations that need to"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_a52226ff","line":21,"updated":"2014-12-16 21:54:47.000000000","message":"lowercase operating system","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"9b0f951d143b66a06c310b995f96759005e13abc","unresolved":false,"context_lines":[{"line_number":20,"context_line":"X509 Certificate management is not trivial.  The Certmonger program was built"},{"line_number":21,"context_line":"to provide the Operating System with a uniformed approach to requesting and"},{"line_number":22,"context_line":"monitoring the status of X509 certificates.  It ensures best practices, such as"},{"line_number":23,"context_line":"never exposing private keys.  Certmonger is capable of working with both"},{"line_number":24,"context_line":"OpenSSL and NSS.  NSS specificially is necessary for organizations that need to"},{"line_number":25,"context_line":"pursue FIPS 140-2 level 3 or higher compliance."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_c0ba79bf","line":23,"updated":"2014-11-13 15:02:46.000000000","message":"Will you be rolling private keys for new certificates or shorter certificates?","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"13e5d0cc133b25af2a8f86c8e49b7be206f4f346","unresolved":false,"context_lines":[{"line_number":20,"context_line":"X509 Certificate management is not trivial.  The Certmonger program was built"},{"line_number":21,"context_line":"to provide the Operating System with a uniformed approach to requesting and"},{"line_number":22,"context_line":"monitoring the status of X509 certificates.  It ensures best practices, such as"},{"line_number":23,"context_line":"never exposing private keys.  Certmonger is capable of working with both"},{"line_number":24,"context_line":"OpenSSL and NSS.  NSS specificially is necessary for organizations that need to"},{"line_number":25,"context_line":"pursue FIPS 140-2 level 3 or higher compliance."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_d71f946a","line":23,"in_reply_to":"5a890539_c0ba79bf","updated":"2014-11-26 15:55:10.000000000","message":"In general, certmonger reuses private keys for re-enrollment.   It just updates the certificates.\n\nI was discussing with one of the developers about a means to do Key roll-over, and what kind of options we\u0027d want to ensure that private keys stay priviate, but that we don\u0027t blow out the memory on small hardward security devices.  But that is future work.","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":30,"context_line":"their existing Public Key Infrastructure (PKI) to manage certificates."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Recent changes to Certmonger have made it possible to support the exisiting"},{"line_number":33,"context_line":"approach of self signed certificates for organizations that do not have PKI."},{"line_number":34,"context_line":"With the new \"local\" signer,  the same tool can now be used for both managed"},{"line_number":35,"context_line":"and unmanaged PKI use cases."},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_e54a6eab","line":33,"updated":"2014-12-16 21:54:47.000000000","message":"self-signed","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":37,"context_line":"Proposed Change"},{"line_number":38,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Instead of calling the code keystone/common/openssl.py, the keystone-manage"},{"line_number":41,"context_line":"operations executed with the pki_setup and ssl_setup command line arguments"},{"line_number":42,"context_line":"intead perform popen calls to Certmonger.  Specifically, the code will perform"},{"line_number":43,"context_line":"the following three steps:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_45d182cc","line":40,"updated":"2014-12-16 21:54:47.000000000","message":"double backticks","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":38,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Instead of calling the code keystone/common/openssl.py, the keystone-manage"},{"line_number":41,"context_line":"operations executed with the pki_setup and ssl_setup command line arguments"},{"line_number":42,"context_line":"intead perform popen calls to Certmonger.  Specifically, the code will perform"},{"line_number":43,"context_line":"the following three steps:"},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_65d67ec7","line":41,"updated":"2014-12-16 21:54:47.000000000","message":"double backticks","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Instead of calling the code keystone/common/openssl.py, the keystone-manage"},{"line_number":41,"context_line":"operations executed with the pki_setup and ssl_setup command line arguments"},{"line_number":42,"context_line":"intead perform popen calls to Certmonger.  Specifically, the code will perform"},{"line_number":43,"context_line":"the following three steps:"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"1. Check that the certmonger and dbus daemons are up and running"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_c5e492ae","line":42,"updated":"2014-12-16 21:54:47.000000000","message":"double backticks","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Instead of calling the code keystone/common/openssl.py, the keystone-manage"},{"line_number":41,"context_line":"operations executed with the pki_setup and ssl_setup command line arguments"},{"line_number":42,"context_line":"intead perform popen calls to Certmonger.  Specifically, the code will perform"},{"line_number":43,"context_line":"the following three steps:"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"1. Check that the certmonger and dbus daemons are up and running"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_a3bd776a","line":42,"updated":"2014-11-13 15:34:05.000000000","message":"instead","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Instead of calling the code keystone/common/openssl.py, the keystone-manage"},{"line_number":41,"context_line":"operations executed with the pki_setup and ssl_setup command line arguments"},{"line_number":42,"context_line":"intead perform popen calls to Certmonger.  Specifically, the code will perform"},{"line_number":43,"context_line":"the following three steps:"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"1. Check that the certmonger and dbus daemons are up and running"},{"line_number":46,"context_line":"2. Check that the user specific dbus listener is installed and running"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_43acd335","line":43,"updated":"2014-11-13 15:34:05.000000000","message":"s/three/seven/","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":42,"context_line":"intead perform popen calls to Certmonger.  Specifically, the code will perform"},{"line_number":43,"context_line":"the following three steps:"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"1. Check that the certmonger and dbus daemons are up and running"},{"line_number":46,"context_line":"2. Check that the user specific dbus listener is installed and running"},{"line_number":47,"context_line":"3. Create the top level directory for holding the certificates."},{"line_number":48,"context_line":"4. List the available CAs exposed via certmonger by exeucting the command"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_45e8a27c","line":45,"updated":"2014-12-16 21:54:47.000000000","message":"anne pointed out in another review that it\u0027s easier to maintain RST docs if you use\n\n  #. Blah blah blah\n\ninstead of actually numbering things manually. just mentioning since this list is fairly long.\n\nalso, some of this work is far out of scope for keystone to fuss over (such as ensuring the \"user-specific dbus listener is installed an running\"). what do you do if it\u0027s not running? try and start it?! focus on the business logic and treat everything else as an exception.","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":45,"context_line":"1. Check that the certmonger and dbus daemons are up and running"},{"line_number":46,"context_line":"2. Check that the user specific dbus listener is installed and running"},{"line_number":47,"context_line":"3. Create the top level directory for holding the certificates."},{"line_number":48,"context_line":"4. List the available CAs exposed via certmonger by exeucting the command"},{"line_number":49,"context_line":"   getcert  list-cas -s"},{"line_number":50,"context_line":"5. Select the appropriate CA.  Select criteria is listed below."},{"line_number":51,"context_line":"6. Execute the python equivalend of the command to request a certificate via"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_c34e0396","line":48,"updated":"2014-11-13 15:34:05.000000000","message":"executing*","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":46,"context_line":"2. Check that the user specific dbus listener is installed and running"},{"line_number":47,"context_line":"3. Create the top level directory for holding the certificates."},{"line_number":48,"context_line":"4. List the available CAs exposed via certmonger by exeucting the command"},{"line_number":49,"context_line":"   getcert  list-cas -s"},{"line_number":50,"context_line":"5. Select the appropriate CA.  Select criteria is listed below."},{"line_number":51,"context_line":"6. Execute the python equivalend of the command to request a certificate via"},{"line_number":52,"context_line":"   certmonger."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_a5fea636","line":49,"updated":"2014-12-16 21:54:47.000000000","message":"double backticks","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":51,"context_line":"6. Execute the python equivalend of the command to request a certificate via"},{"line_number":52,"context_line":"   certmonger."},{"line_number":53,"context_line":"7. Report the status of the call.  For some workflows, the signing of the"},{"line_number":54,"context_line":"   request  may not be autonmated.  In these cases, certmonger will poll every"},{"line_number":55,"context_line":"   12 hours."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"To speed up the fetch after a certificate has been signed, but before"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_e33cdfe4","line":54,"updated":"2014-11-13 15:34:05.000000000","message":"automated*","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":52,"context_line":"   certmonger."},{"line_number":53,"context_line":"7. Report the status of the call.  For some workflows, the signing of the"},{"line_number":54,"context_line":"   request  may not be autonmated.  In these cases, certmonger will poll every"},{"line_number":55,"context_line":"   12 hours."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"To speed up the fetch after a certificate has been signed, but before"},{"line_number":58,"context_line":"certmonger has polled for it, a user can call getcert with the id of the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_e313ff63","line":55,"updated":"2014-11-13 15:34:05.000000000","message":"Will/should this polling be configurable?","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Alternatives"},{"line_number":66,"context_line":"------------"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Thereis no real alternative to certmonger for talking to different CAs."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Once Barbican has a REST url for posting a CSR, KEystone could be hard coded to"},{"line_number":71,"context_line":"use that, but the certmonger approach is more flexible.  Instead, a barbiacan"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_d60a4320","line":68,"updated":"2014-11-13 15:34:05.000000000","message":"There is*","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Thereis no real alternative to certmonger for talking to different CAs."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Once Barbican has a REST url for posting a CSR, KEystone could be hard coded to"},{"line_number":71,"context_line":"use that, but the certmonger approach is more flexible.  Instead, a barbiacan"},{"line_number":72,"context_line":"CLI configured with the local server could easily be turned into a certmonger"},{"line_number":73,"context_line":"plugin."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_9627dbb5","line":70,"updated":"2014-11-13 15:34:05.000000000","message":"Keystone*","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"9b0f951d143b66a06c310b995f96759005e13abc","unresolved":false,"context_lines":[{"line_number":73,"context_line":"plugin."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Security Impact"},{"line_number":76,"context_line":"---------------"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":79,"context_line":"consider include:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_cca555b6","line":76,"updated":"2014-11-13 15:02:46.000000000","message":"Thank you for including this section.","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":73,"context_line":"plugin."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Security Impact"},{"line_number":76,"context_line":"---------------"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":79,"context_line":"consider include:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_a52146b6","line":76,"in_reply_to":"5a890539_cca555b6","updated":"2014-12-16 21:54:47.000000000","message":"except... i learn *nothing* from what is included here","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":76,"context_line":"---------------"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":79,"context_line":"consider include:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":82,"context_line":"*  Yes, it cleans up the approach to managing PKI, specifically the certs used"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_c580128e","line":79,"updated":"2014-12-16 21:54:47.000000000","message":"can you clean up this section so that you\u0027re not including the template text (which is intended for the spec author, not the readers)","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":82,"context_line":"*  Yes, it cleans up the approach to managing PKI, specifically the certs used"},{"line_number":83,"context_line":"   for signing tokens and for SSL."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":86,"context_line":"  a new way to access sensitive information or a new way to login?"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_05313a0b","line":83,"updated":"2014-12-16 21:54:47.000000000","message":"despite the usage of the \"specifically ..\" phrasing, this is spectacularly vague","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":86,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":87,"context_line":"* Yes, see above."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":90,"context_line":"*  Yes, see above"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_45442274","line":87,"updated":"2014-12-16 21:54:47.000000000","message":"the above does not mention API impact ... ??","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":87,"context_line":"* Yes, see above."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":90,"context_line":"*  Yes, see above"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":93,"context_line":"* No"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_65403e57","line":90,"updated":"2014-12-16 21:54:47.000000000","message":"nothing in this spec discusses crypto -- there\u0027s no \"above\" to reference","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"9b0f951d143b66a06c310b995f96759005e13abc","unresolved":false,"context_lines":[{"line_number":90,"context_line":"*  Yes, see above"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":93,"context_line":"* No"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":96,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_6cf3819e","line":93,"updated":"2014-11-13 15:02:46.000000000","message":"What user/privileges are used for managing the private key?","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"13e5d0cc133b25af2a8f86c8e49b7be206f4f346","unresolved":false,"context_lines":[{"line_number":90,"context_line":"*  Yes, see above"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":93,"context_line":"* No"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":96,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_f2ae5e80","line":93,"in_reply_to":"5a890539_6cf3819e","updated":"2014-11-26 15:55:10.000000000","message":"It managed based on the file security of the key database.   There are options for password protected databases.  \n\nIt will do certain operations on a password protected database, and hold on to certificates in  \"i need that password\" state.  Ideally, when working with it, you write the password to a file to avoid passing it on the command line, then destroy the file.  Etc.","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"54e5d01a9a011480d5e77ea4f9536e6c3aa88eb6","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":96,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":97,"context_line":"*  Yes, but certmonger has been doing that for years."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":100,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_8812a156","line":97,"updated":"2014-12-16 21:54:47.000000000","message":"lol, i don\u0027t know where to begin.","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":118,"context_line":"Performance Impact"},{"line_number":119,"context_line":"------------------"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"None.  THis is at configuration time only."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Other Deployer Impact"},{"line_number":124,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_16692bbe","line":121,"updated":"2014-11-13 15:34:05.000000000","message":"This*","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":136,"context_line":"  something that has to be explicitly enabled?"},{"line_number":137,"context_line":"* Immeditely after merged.  It repalces the current logic in"},{"line_number":138,"context_line":"  keystone/common/openssl.py"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"* If this change is a new binary, how would it be deployed?"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_f6a9ffdf","line":137,"updated":"2014-11-13 15:34:05.000000000","message":"replaces*","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":135,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":136,"context_line":"  something that has to be explicitly enabled?"},{"line_number":137,"context_line":"* Immeditely after merged.  It repalces the current logic in"},{"line_number":138,"context_line":"  keystone/common/openssl.py"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"* If this change is a new binary, how would it be deployed?"},{"line_number":141,"context_line":"*  It is provided by the operating system base platform install."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_b6d4d747","line":138,"updated":"2014-11-13 15:34:05.000000000","message":"What else is keystone/common/openssl.py used for? If it isn\u0027t used for much outside the scope of this, removal of openssl.py could be worked in as clean up after this implementation is landed.\n\nThe last time I checked openssl.py doesn\u0027t use a standard library and there is an outstanding bug open for that. This could potentially take care of that too. \n\nhttps://bugs.launchpad.net/keystone/+bug/1198183","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  instance directories created before the change landed?  Do we move them?  Do"},{"line_number":148,"context_line":"  we have a special case in the code? Do we assume that the operator will"},{"line_number":149,"context_line":"  recreate all the instances in their cloud?"},{"line_number":150,"context_line":"*  If deployers are using a real CA, they should encourage their vendor to"},{"line_number":151,"context_line":"   provide a certmonger  plugin."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_f613bf0a","line":150,"updated":"2014-11-13 15:34:05.000000000","message":"define \"real CA\"","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":199,"context_line":"Documentation Impact"},{"line_number":200,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"Document the requirement to installCertmonger and dbus on base OS."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_16212b4d","line":202,"updated":"2014-11-13 15:34:05.000000000","message":"install Certmonger*","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"448fa8745b6efc0cddc7f9688f038acf49f4d541","unresolved":false,"context_lines":[{"line_number":206,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"* https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/getting-started.txt"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"* http://en.wikipedia.org/wiki/FIPS_140"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_f6e1fffe","line":209,"updated":"2014-11-13 15:34:05.000000000","message":"suggest changing to .rst link format","commit_id":"147f6329466afa1047e38827d09293a3f9392425"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b10692144cdcb68e564b03e01f5dfcec647d6414","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"The current configuration options that indicate the top level directory for"},{"line_number":66,"context_line":"holding the keys and certificates will be passed in the popen call to"},{"line_number":67,"context_line":"certmonger."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":""},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_d7bb5c0c","line":67,"updated":"2015-01-28 16:31:22.000000000","message":"I have 1 major concern here and a minor concern:\n\nAnother dependency is being added, and I\u0027m not sure how certmonger is going to handle things in the case we\u0027re missing IPA or other similar dogtag store. Please add some minor clarification on these details (or if certmonger is the preferred but not required method).\n\nWhat versions of Ubuntu, Suse, Fedora, etc does certmonger run on? (how painful is this for our packagers). If this is not available for (at least) 14.04 already this is a no-go.\n\nOtherwise this looks like a reasonable change.","commit_id":"dce9c3d10ef3e8f113f1e258bf3458b3a37770fd"}]}