)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7060,"name":"Simo Sorce","email":"simo@redhat.com","username":"simo"},"change_message_id":"b3269f4c96ae94d1f9537a23c73b295441ed9252","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Generate HTTPS certificates in pki_create."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Fixes bug 1155361"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: Ia34827583bcdfbd871133250681010e642271f07"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAAOn%2F%2F%2BQk%3D","line":9,"updated":"2013-04-09 16:02:27.000000000","message":"Please describe what is the intended change and how it is done in practice in the patch, including if there are things to be aware of (changes in behavior, additional requirements for othe rcomponents, etc...)","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"eb49af6936b84662c25de7dfdb61daa79edbe575","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Jamie Lennox \u003cjlennox@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2013-04-10 16:19:24 +1000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Generate HTTPS certificates with ssl_create."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Extracts common OpenSSL functionality from pki_create and adds a new cli"},{"line_number":10,"context_line":"command ssl_create which re-uses this base to generate SSL certificates"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAOn%2F%2F8J8%3D","line":7,"updated":"2013-04-10 20:04:00.000000000","message":"ssl_setup?","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"}],"doc/source/configuration.rst":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fbaeb5d05d60e24c2e2f920f5dc179f8d6b4ed7d","unresolved":false,"context_lines":[{"line_number":362,"context_line":"Keystone may be configured to support SSL and 2-way SSL out-of-the-box. "},{"line_number":363,"context_line":"The X509 certificates used by keystone can be generated by keystone-manage or "},{"line_number":364,"context_line":"obtained externally and configured for use with Keystone as described in this "},{"line_number":365,"context_line":"section.  "},{"line_number":366,"context_line":"Here is the description of each of them and their purpose:"},{"line_number":367,"context_line":""},{"line_number":368,"context_line":"Types of certificates"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAOn%2F%2F8ps%3D","line":365,"updated":"2013-04-10 16:11:06.000000000","message":"Whitespace","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fbaeb5d05d60e24c2e2f920f5dc179f8d6b4ed7d","unresolved":false,"context_lines":[{"line_number":409,"context_line":""},{"line_number":410,"context_line":"When generating SSL certificates the following values are read"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":"* ``key_size``: Key size to create. Defaults to 1024. "},{"line_number":413,"context_line":"* ``valid_days``: How long the certificate is valid for. Defaults to 3650 (10 years). "},{"line_number":414,"context_line":"* ``ca_password``: The password for the CA private key. Defaults to None. "},{"line_number":415,"context_line":"* ``cert_subject``: The subject to set in the certificate. Defaults to /C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003dlocalhost. When setting the subject it is important to set CN to be the address of the server so client validation will succeed. This generally means having the subject be at least /CN\u003d\u003ckeystone ip\u003e "}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAOn%2F%2F8po%3D","line":412,"updated":"2013-04-10 16:11:06.000000000","message":"In the Config file for the Cert (openssl.py) you origianlly generated a default size of  2048.  Should we go with 2048 everywhere?","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b21247f5f230de4c107a9482d714e5bed5a961e1","unresolved":false,"context_lines":[{"line_number":409,"context_line":""},{"line_number":410,"context_line":"When generating SSL certificates the following values are read"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":"* ``key_size``: Key size to create. Defaults to 1024. "},{"line_number":413,"context_line":"* ``valid_days``: How long the certificate is valid for. Defaults to 3650 (10 years). "},{"line_number":414,"context_line":"* ``ca_password``: The password for the CA private key. Defaults to None. "},{"line_number":415,"context_line":"* ``cert_subject``: The subject to set in the certificate. Defaults to /C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003dlocalhost. When setting the subject it is important to set CN to be the address of the server so client validation will succeed. This generally means having the subject be at least /CN\u003d\u003ckeystone ip\u003e "}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAOn%2F%2F7zs%3D","line":412,"in_reply_to":"AAAAOn%2F%2F8po%3D","updated":"2013-04-10 23:17:14.000000000","message":"I had changed the config file over to 2048, but put it back with this commit. In general I would pick 2048, but historically (i think it\u0027s for older browsers) web certificates are supposed to be 1024. \n\nIt probably doesn\u0027t matter here.","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"}],"etc/keystone.conf.sample":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"83cb8d63e9e9377420fa81040064df4b9f38e2a6","unresolved":false,"context_lines":[{"line_number":124,"context_line":"#keyfile \u003d /etc/keystone/ssl/private/keystonekey.pem"},{"line_number":125,"context_line":"#ca_certs \u003d /etc/keystone/ssl/certs/ca.pem"},{"line_number":126,"context_line":"#cert_cn \u003d localhost"},{"line_number":127,"context_line":"#cert_required \u003d False"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"[signing]"},{"line_number":130,"context_line":"#token_format \u003d PKI"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAOn%2F%2F%2BU8%3D","line":127,"updated":"2013-04-09 15:57:44.000000000","message":"Nice catch.","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"}],"keystone/common/config.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4c5f8c7af3554848c08ed74d50adff166828feb1","unresolved":false,"context_lines":[{"line_number":215,"context_line":"    register_str(\u0027keyfile\u0027, group\u003d\u0027ssl\u0027,"},{"line_number":216,"context_line":"                 default\u003d\"/etc/keystone/ssl/private/keystonekey.pem\")"},{"line_number":217,"context_line":"    register_str(\u0027ca_certs\u0027, group\u003d\u0027ssl\u0027,"},{"line_number":218,"context_line":"                 default\u003d\"/etc/keystone/ssl/certs/ca.pem\")"},{"line_number":219,"context_line":"    register_bool(\u0027cert_required\u0027, group\u003d\u0027ssl\u0027, default\u003dFalse)"},{"line_number":220,"context_line":"    register_int(\u0027key_size\u0027, group\u003d\u0027ssl\u0027, default\u003d1024)"},{"line_number":221,"context_line":"    register_int(\u0027valid_days\u0027, group\u003d\u0027ssl\u0027, default\u003d3650)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOn%2F%2F8KI%3D","line":218,"updated":"2013-04-10 20:03:35.000000000","message":"i\u0027d like to see the same default naming conventions used between \u0027ssl\u0027 certs and \u0027signing\u0027 certs","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3edd86c98efe7f94475a7b090533d18c06892b5e","unresolved":false,"context_lines":[{"line_number":215,"context_line":"    register_str(\u0027keyfile\u0027, group\u003d\u0027ssl\u0027,"},{"line_number":216,"context_line":"                 default\u003d\"/etc/keystone/ssl/private/keystonekey.pem\")"},{"line_number":217,"context_line":"    register_str(\u0027ca_certs\u0027, group\u003d\u0027ssl\u0027,"},{"line_number":218,"context_line":"                 default\u003d\"/etc/keystone/ssl/certs/ca.pem\")"},{"line_number":219,"context_line":"    register_bool(\u0027cert_required\u0027, group\u003d\u0027ssl\u0027, default\u003dFalse)"},{"line_number":220,"context_line":"    register_int(\u0027key_size\u0027, group\u003d\u0027ssl\u0027, default\u003d1024)"},{"line_number":221,"context_line":"    register_int(\u0027valid_days\u0027, group\u003d\u0027ssl\u0027, default\u003d3650)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOn%2F%2F7nc%3D","line":218,"in_reply_to":"AAAAOn%2F%2F7uQ%3D","updated":"2013-04-11 01:14:16.000000000","message":"Leave them as is, or it will break existing installs.","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b21247f5f230de4c107a9482d714e5bed5a961e1","unresolved":false,"context_lines":[{"line_number":215,"context_line":"    register_str(\u0027keyfile\u0027, group\u003d\u0027ssl\u0027,"},{"line_number":216,"context_line":"                 default\u003d\"/etc/keystone/ssl/private/keystonekey.pem\")"},{"line_number":217,"context_line":"    register_str(\u0027ca_certs\u0027, group\u003d\u0027ssl\u0027,"},{"line_number":218,"context_line":"                 default\u003d\"/etc/keystone/ssl/certs/ca.pem\")"},{"line_number":219,"context_line":"    register_bool(\u0027cert_required\u0027, group\u003d\u0027ssl\u0027, default\u003dFalse)"},{"line_number":220,"context_line":"    register_int(\u0027key_size\u0027, group\u003d\u0027ssl\u0027, default\u003d1024)"},{"line_number":221,"context_line":"    register_int(\u0027valid_days\u0027, group\u003d\u0027ssl\u0027, default\u003d3650)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOn%2F%2F7uQ%3D","line":218,"in_reply_to":"AAAAOn%2F%2F8KI%3D","updated":"2013-04-10 23:17:14.000000000","message":"These were used as they are the defaults provided in the original keystone.conf.sample and specified in the docs. Am i right to assume that changing them (in all places) doesn\u0027t matter?","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"}],"keystone/common/openssl.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"83cb8d63e9e9377420fa81040064df4b9f38e2a6","unresolved":false,"context_lines":[{"line_number":31,"context_line":"PRIV_PERMS \u003d stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"BASE_SUBJECT \u003d \u0027/C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003d%s\u0027"},{"line_number":34,"context_line":"DEFAULT_SUBJECT \u003d BASE_SUBJECT % \u0027www.example.com\u0027"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"def file_exists(file_path):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAOn%2F%2F%2BUs%3D","line":34,"updated":"2013-04-09 15:57:44.000000000","message":"Sample data like this does not belong in this file.  If these values are required, put them as the defaults in config.py","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc637d8c472c0e3c3964b540f9dafadffe499f8c","unresolved":false,"context_lines":[{"line_number":31,"context_line":"PRIV_PERMS \u003d stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"BASE_SUBJECT \u003d \u0027/C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003d%s\u0027"},{"line_number":34,"context_line":"DEFAULT_SUBJECT \u003d BASE_SUBJECT % \u0027www.example.com\u0027"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"def file_exists(file_path):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAOn%2F%2F9ZE%3D","line":34,"in_reply_to":"AAAAOn%2F%2F%2BUs%3D","updated":"2013-04-10 05:13:55.000000000","message":"Don\u0027t think they are required. There\u0027s a very good chance these certs will be replaced with commercial CA issued certs in production anyway.\n\nFor mom \u0026 pop deployments, less configuration is better.","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"83cb8d63e9e9377420fa81040064df4b9f38e2a6","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        to_exec \u003d command % ssl_dictionary"},{"line_number":88,"context_line":"        LOG.info(to_exec)"},{"line_number":89,"context_line":"        print to_exec"},{"line_number":90,"context_line":"        subprocess.check_call(to_exec.rsplit(\u0027 \u0027))"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    def build_ssl_config_file(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAOn%2F%2F%2BUY%3D","line":89,"updated":"2013-04-09 15:57:44.000000000","message":"This looks like debugging. Please remove","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"},{"author":{"_account_id":7060,"name":"Simo Sorce","email":"simo@redhat.com","username":"simo"},"change_message_id":"b3269f4c96ae94d1f9537a23c73b295441ed9252","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        to_exec \u003d command % ssl_dictionary"},{"line_number":88,"context_line":"        LOG.info(to_exec)"},{"line_number":89,"context_line":"        print to_exec"},{"line_number":90,"context_line":"        subprocess.check_call(to_exec.rsplit(\u0027 \u0027))"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    def build_ssl_config_file(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAOn%2F%2F%2BSo%3D","line":89,"updated":"2013-04-09 16:02:27.000000000","message":"does this print really belong to the final patch ?\nLooks like a temporary debugging aid","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"},{"author":{"_account_id":7060,"name":"Simo Sorce","email":"simo@redhat.com","username":"simo"},"change_message_id":"b3269f4c96ae94d1f9537a23c73b295441ed9252","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            self._set_permissions(self.ssl_dictionary[\u0027ca_cert\u0027], CERT_PERMS)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    def _build_private_key(self, keyfile):"},{"line_number":131,"context_line":"        # signing_keyfile \u003d self.ssl_dictionary[\u0027signing_key\u0027]"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"        if not file_exists(keyfile):"},{"line_number":134,"context_line":"            self._make_dirs(keyfile)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAOn%2F%2F%2BSM%3D","line":131,"updated":"2013-04-09 16:02:27.000000000","message":"This should probably be removed from the final patch.","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"83cb8d63e9e9377420fa81040064df4b9f38e2a6","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            self._set_permissions(self.ssl_dictionary[\u0027ca_cert\u0027], CERT_PERMS)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    def _build_private_key(self, keyfile):"},{"line_number":131,"context_line":"        # signing_keyfile \u003d self.ssl_dictionary[\u0027signing_key\u0027]"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"        if not file_exists(keyfile):"},{"line_number":134,"context_line":"            self._make_dirs(keyfile)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAOn%2F%2F%2BSA%3D","line":131,"updated":"2013-04-09 15:57:44.000000000","message":"remove","commit_id":"6e5d0027e9c39c518ffbcfefc566af073a0f64d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b21247f5f230de4c107a9482d714e5bed5a961e1","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        self.use_keystone_user \u003d keystone_user"},{"line_number":45,"context_line":"        self.use_keystone_group \u003d keystone_group"},{"line_number":46,"context_line":"        self.ssl_config_file_name \u003d os.path.join(self.conf_dir, \"openssl.conf\")"},{"line_number":47,"context_line":"        self.ca_key_file \u003d os.path.join(self.conf_dir, \"cakey.pem\")"},{"line_number":48,"context_line":"        self.request_file_name \u003d os.path.join(self.conf_dir, \"req.pem\")"},{"line_number":49,"context_line":"        self.ssl_dictionary \u003d {\u0027conf_dir\u0027: self.conf_dir,"},{"line_number":50,"context_line":"                               \u0027ca_cert\u0027: conf_obj.ca_certs,"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOn%2F%2F7uI%3D","line":47,"updated":"2013-04-10 23:17:14.000000000","message":"Should this also be a configuration option?","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3edd86c98efe7f94475a7b090533d18c06892b5e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        self.use_keystone_user \u003d keystone_user"},{"line_number":45,"context_line":"        self.use_keystone_group \u003d keystone_group"},{"line_number":46,"context_line":"        self.ssl_config_file_name \u003d os.path.join(self.conf_dir, \"openssl.conf\")"},{"line_number":47,"context_line":"        self.ca_key_file \u003d os.path.join(self.conf_dir, \"cakey.pem\")"},{"line_number":48,"context_line":"        self.request_file_name \u003d os.path.join(self.conf_dir, \"req.pem\")"},{"line_number":49,"context_line":"        self.ssl_dictionary \u003d {\u0027conf_dir\u0027: self.conf_dir,"},{"line_number":50,"context_line":"                               \u0027ca_cert\u0027: conf_obj.ca_certs,"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOn%2F%2F7nU%3D","line":47,"in_reply_to":"AAAAOn%2F%2F7uI%3D","updated":"2013-04-11 01:14:16.000000000","message":"Probably, so long as the default values are these here, it should not break anything.","commit_id":"6effd763ce093028c61695bd07e1fa7918a7ed26"}]}