)]}'
{"keystone/compat/aws/s3.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6925af358f954520d8692654e636df31904c90fc","unresolved":false,"context_lines":[{"line_number":123,"context_line":"        if len(scope) !\u003d 4 or scope[2] !\u003d b\u0027s3\u0027 or scope[3] !\u003d b\u0027aws4_request\u0027:"},{"line_number":124,"context_line":"            raise exception.Unauthorized(message\u003d_(\u0027Invalid EC2 signature.\u0027))"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        def _sign(key, msg):"},{"line_number":127,"context_line":"            return hmac.new(key, msg, hashlib.sha256).digest()"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"        signed \u003d _sign((\u0027AWS4\u0027 + secret_key).encode(\u0027utf-8\u0027), scope[0])"},{"line_number":130,"context_line":"        signed \u003d _sign(signed, scope[1])"},{"line_number":131,"context_line":"        signed \u003d _sign(signed, scope[2])"},{"line_number":132,"context_line":"        signed \u003d _sign(signed, b\u0027aws4_request\u0027)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        signature \u003d hmac.new(signed, string_to_sign, hashlib.sha256)"},{"line_number":135,"context_line":"        return signature.hexdigest()"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_3e155d48","line":132,"range":{"start_line":126,"start_character":8,"end_line":132,"end_character":47},"updated":"2016-02-05 03:17:40.000000000","message":"this may not say anything about aws or buckets, but it looks very similar to what is posted here: http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python","commit_id":"d37a7baa99db88ea99e31b57c7ada52c13bca4e9"}],"keystone/compat/aws/s3/controllers.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"172a93080444456e2ffcf98116e5c656eecefa43","unresolved":false,"context_lines":[{"line_number":31,"context_line":"if _s3_core:"},{"line_number":32,"context_line":"    S3Controller \u003d _s3_core.S3Controller"},{"line_number":33,"context_line":"else:"},{"line_number":34,"context_line":"    S3Controller \u003d compat._AllMethodsForbiddenControllerV2"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a5ae5dd_342e75fb","line":34,"updated":"2016-02-08 17:25:30.000000000","message":"v2 because S3Controller is currently v2-specific? It does look like it is... But if so, then we shouldn\u0027t be using this in the v3 pipeline.","commit_id":"d6f6ec402c64f48bf18439b74038d898e68fb684"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b125bdf0e4ea83ffd50a6c01566b9d72e38a33ce","unresolved":false,"context_lines":[{"line_number":31,"context_line":"if _s3_core:"},{"line_number":32,"context_line":"    S3Controller \u003d _s3_core.S3Controller"},{"line_number":33,"context_line":"else:"},{"line_number":34,"context_line":"    S3Controller \u003d compat._AllMethodsForbiddenControllerV2"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a5ae5dd_4380108b","line":34,"in_reply_to":"5a5ae5dd_342e75fb","updated":"2016-02-08 18:36:36.000000000","message":"See other comment. You are correct, but it\u0027s what we have done until now.","commit_id":"d6f6ec402c64f48bf18439b74038d898e68fb684"}],"keystone/contrib/s3/core.py":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"a1b9885f9dc09ce42f597a716e407d195536de34","unresolved":false,"context_lines":[{"line_number":23,"context_line":"class S3Extension(wsgi.Middleware):"},{"line_number":24,"context_line":"    def __init__(self, *args, **kwargs):"},{"line_number":25,"context_line":"        super(S3Extension, self).__init__(*args, **kwargs)"},{"line_number":26,"context_line":"        msg \u003d _(\"Remove s3_extension from the paste pipeline, the \""},{"line_number":27,"context_line":"                \"s3 extension is now always available. Update the \""},{"line_number":28,"context_line":"                \"[pipeline:api_v3], [pipeline:admin_api], and \""},{"line_number":29,"context_line":"                \"[pipeline:public_api] section in keystone-paste.ini \""}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_c06831f8","line":26,"updated":"2016-02-03 21:28:24.000000000","message":"I love these types of deprecation messages.  Keeps folks out of trouble and nudges them to do the right thing :-)","commit_id":"d37a7baa99db88ea99e31b57c7ada52c13bca4e9"}],"keystone/version/service.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"305211434fe6754b9a97e071a763567ef5a7c5f6","unresolved":false,"context_lines":[{"line_number":24,"context_line":"from keystone.auth import routers as auth_routers"},{"line_number":25,"context_line":"from keystone.catalog import routers as catalog_routers"},{"line_number":26,"context_line":"from keystone.common import wsgi"},{"line_number":27,"context_line":"from keystone.compat.aws import s3"},{"line_number":28,"context_line":"from keystone.credential import routers as credential_routers"},{"line_number":29,"context_line":"from keystone.endpoint_policy import routers as endpoint_policy_routers"},{"line_number":30,"context_line":"from keystone.federation import routers as federation_routers"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_483c2de2","line":27,"updated":"2016-02-04 19:25:14.000000000","message":"When we had a product (and there are still some OpenStack products in IBM), we were told by our lawyers to remove this module and not provide the s3 compatibility layer. Can we make this optional (as in, do a try import and then don\u0027t add to the composing router if it\u0027s not available)?","commit_id":"d37a7baa99db88ea99e31b57c7ada52c13bca4e9"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e964683afea20fb98f2660e08322e5ab25110ae2","unresolved":false,"context_lines":[{"line_number":24,"context_line":"from keystone.auth import routers as auth_routers"},{"line_number":25,"context_line":"from keystone.catalog import routers as catalog_routers"},{"line_number":26,"context_line":"from keystone.common import wsgi"},{"line_number":27,"context_line":"from keystone.compat.aws import s3"},{"line_number":28,"context_line":"from keystone.credential import routers as credential_routers"},{"line_number":29,"context_line":"from keystone.endpoint_policy import routers as endpoint_policy_routers"},{"line_number":30,"context_line":"from keystone.federation import routers as federation_routers"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_737a3ef3","line":27,"in_reply_to":"5a5ae5dd_483c2de2","updated":"2016-02-04 19:44:35.000000000","message":"+++ Great catch Brant!","commit_id":"d37a7baa99db88ea99e31b57c7ada52c13bca4e9"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"392413a70fc5fcb1ba40e31ed786df30147b1d6b","unresolved":false,"context_lines":[{"line_number":24,"context_line":"from keystone.auth import routers as auth_routers"},{"line_number":25,"context_line":"from keystone.catalog import routers as catalog_routers"},{"line_number":26,"context_line":"from keystone.common import wsgi"},{"line_number":27,"context_line":"from keystone.compat.aws import s3"},{"line_number":28,"context_line":"from keystone.credential import routers as credential_routers"},{"line_number":29,"context_line":"from keystone.endpoint_policy import routers as endpoint_policy_routers"},{"line_number":30,"context_line":"from keystone.federation import routers as federation_routers"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_9467a024","line":27,"in_reply_to":"5a5ae5dd_737a3ef3","updated":"2016-02-04 21:03:08.000000000","message":"See the follow-on patch for an example: https://review.openstack.org/276444","commit_id":"d37a7baa99db88ea99e31b57c7ada52c13bca4e9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"248f010bf2fbf7e75ab9ed5917c24d1e71a39c8f","unresolved":false,"context_lines":[{"line_number":24,"context_line":"from keystone.auth import routers as auth_routers"},{"line_number":25,"context_line":"from keystone.catalog import routers as catalog_routers"},{"line_number":26,"context_line":"from keystone.common import wsgi"},{"line_number":27,"context_line":"from keystone.compat.aws import s3"},{"line_number":28,"context_line":"from keystone.credential import routers as credential_routers"},{"line_number":29,"context_line":"from keystone.endpoint_policy import routers as endpoint_policy_routers"},{"line_number":30,"context_line":"from keystone.federation import routers as federation_routers"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_fe210eb5","line":27,"in_reply_to":"5a5ae5dd_9467a024","updated":"2016-02-04 22:09:55.000000000","message":"policy.json for deny. That is the answer. This is the best way to do it.\n\nI am against making this optional if we support it in keystone. policy.json deny is the easiest/best way to ensure no one accesses it.","commit_id":"d37a7baa99db88ea99e31b57c7ada52c13bca4e9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a6cccfbb0bf3f3ff528df54deadf07756ed04160","unresolved":false,"context_lines":[{"line_number":24,"context_line":"from keystone.auth import routers as auth_routers"},{"line_number":25,"context_line":"from keystone.catalog import routers as catalog_routers"},{"line_number":26,"context_line":"from keystone.common import wsgi"},{"line_number":27,"context_line":"from keystone.compat.aws import s3"},{"line_number":28,"context_line":"from keystone.credential import routers as credential_routers"},{"line_number":29,"context_line":"from keystone.endpoint_policy import routers as endpoint_policy_routers"},{"line_number":30,"context_line":"from keystone.federation import routers as federation_routers"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_f50b6828","line":27,"in_reply_to":"5a5ae5dd_fe210eb5","updated":"2016-02-05 01:27:56.000000000","message":"++. I think you can also deny access for certain APIs at Apache using \u003cLocationMatch ..\u003e Deny from all \u003c/LocationMatch\u003e.","commit_id":"d37a7baa99db88ea99e31b57c7ada52c13bca4e9"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"172a93080444456e2ffcf98116e5c656eecefa43","unresolved":false,"context_lines":[{"line_number":143,"context_line":"                       revoke_routers,"},{"line_number":144,"context_line":"                       federation_routers,"},{"line_number":145,"context_line":"                       oauth1_routers,"},{"line_number":146,"context_line":"                       s3_routers,"},{"line_number":147,"context_line":"                       # TODO(morganfainberg): Remove the simple_cert router"},{"line_number":148,"context_line":"                       # when PKI and PKIZ tokens are removed."},{"line_number":149,"context_line":"                       simple_cert_ext]"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a5ae5dd_efac83a0","line":146,"updated":"2016-02-08 17:25:30.000000000","message":"the s3 code appears to be v2-specific (e.g. relying on the v2 version of the EC2 controller). So should this really be included here?","commit_id":"d6f6ec402c64f48bf18439b74038d898e68fb684"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b125bdf0e4ea83ffd50a6c01566b9d72e38a33ce","unresolved":false,"context_lines":[{"line_number":143,"context_line":"                       revoke_routers,"},{"line_number":144,"context_line":"                       federation_routers,"},{"line_number":145,"context_line":"                       oauth1_routers,"},{"line_number":146,"context_line":"                       s3_routers,"},{"line_number":147,"context_line":"                       # TODO(morganfainberg): Remove the simple_cert router"},{"line_number":148,"context_line":"                       # when PKI and PKIZ tokens are removed."},{"line_number":149,"context_line":"                       simple_cert_ext]"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a5ae5dd_a3aea42b","line":146,"in_reply_to":"5a5ae5dd_efac83a0","updated":"2016-02-08 18:36:36.000000000","message":"Replicating the code as it sits before correcting it. Correct, i\u0027ll have a fix down the chain to create a proper V3 router.","commit_id":"d6f6ec402c64f48bf18439b74038d898e68fb684"}]}